Securify

Microsoft has issued an emergency out-of-band security update for on-premises Exchange Server after discovering a high-severity vulnerability that allows any authenticated user to read the email messages and attachments of other users within the same organization. The flaw, tracked as CVE-2026-96940, carries a CVSS base score of 8.8 and is rated “Exploitation More Likely” by Microsoft — a designation that should put every Exchange administrator on alert.

What Happened

On October 2, 2026, Microsoft released a revised security update package — branded the “September 2026 V2” update — that supplements the regular monthly Exchange Server patch with a fix for CVE-2026-96940. The vulnerability was discovered internally by Microsoft researcher Jan Mitchell and stems from weak authorization controls within Exchange Server’s resource access model.

In practical terms, the bug means that a user who holds valid credentials on an Exchange deployment — even a low-privilege account — can escalate their access over the network and read email messages and attachments belonging to other users in the same organization. The attacker does not need any special administrative role, nor does the attack require user interaction on the victim’s side. The flaw does not permit cross-tenant access, which means Exchange Online multi-tenant boundaries remain intact, but within a single organization the exposure is sweeping.

Microsoft has already deployed a service-side fix for Exchange Online customers, who need to take no action. The emergency update targets organizations still running on-premises Exchange — a population that remains substantial, particularly in government, finance, healthcare, and enterprises with strict data-residency requirements.

Technical Breakdown

According to Microsoft’s Security Update Guide and independent analysis, CVE-2026-96940 is classified as an elevation of privilege vulnerability rooted in weak authorization. Its full CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which breaks down to a network-based attack of low complexity, requiring only low-level privileges and no user interaction.

All three pillars of the CIA triad — confidentiality, integrity, and availability — receive a “High” impact rating. While the confidentiality impact is the most immediately alarming (unauthorized mailbox access), the high integrity and availability scores suggest the underlying authorization weakness could potentially be leveraged for broader abuse beyond simple mailbox snooping.

Microsoft has not published a detailed proof-of-concept or full technical write-up, likely to give organizations time to patch before exploitation techniques become widely understood. The company states it is “not aware of active exploitation in the wild” but explicitly warns that this class of vulnerability “could be consistently exploited,” pointing to the long history of Exchange Server flaws being weaponized by both nation-state actors and financially motivated threat groups.

Who Is Affected

The V2 update applies to the following on-premises Exchange Server versions:

• Exchange Server Subscription Edition (SE) — RTM
• Exchange Server 2019 — Cumulative Updates 14 and 15
• Exchange Server 2016 — Cumulative Update 23

There is an important licensing wrinkle: Exchange Server 2016 and 2019 have both reached end-of-support status. Organizations must be enrolled in Microsoft’s Period 2 Extended Security Update (ESU) program to receive this patch. Those that have not enrolled — or that are running even older, unsupported versions — will not receive the fix and remain vulnerable.

Exchange Online customers are unaffected, as Microsoft deployed the fix server-side before the public announcement. However, the rollout was not without confusion: the security updates were published before the accompanying documentation was fully available, leading to uncertainty among administrators about what, exactly, the V2 package contained and why it was being pushed outside the normal Patch Tuesday cadence.

Why This Matters

Exchange Server has been one of the most targeted enterprise products in recent years. The 2021 ProxyLogon and ProxyShell campaigns demonstrated how quickly Exchange vulnerabilities can be mass-exploited once details become public, and the fallout from those incidents — including widespread ransomware deployments and espionage operations — reshaped how organizations think about email server security.

CVE-2026-96940 is particularly concerning because the barrier to exploitation is low. The attacker needs only a valid set of credentials — something readily obtainable through phishing, credential stuffing, or purchasing stolen credentials on dark web marketplaces. Once inside, the ability to silently read any mailbox in the organization without triggering obvious alerts opens the door to corporate espionage, insider trading, executive impersonation, and data exfiltration at scale.

The “Exploitation More Likely” assessment from Microsoft is not a label the company applies casually. It signals that the vulnerability is reliable, reproducible, and likely to attract attacker interest once enough details circulate for reverse engineering of the patch.

Known Issues With the Patch

Administrators should be aware of two known issues in the V2 release. First, there are published calendar formatting errors that may affect how calendar items are displayed. Second, a ContentEngine deadlock has been identified that specifically impacts Korean-language email processing. Microsoft has acknowledged both issues and is expected to address them in subsequent updates.

What to Do Now

If you are running on-premises Exchange Server, treat this patch as urgent. Microsoft recommends the following steps:

• Inventory your environment by running the Exchange Server Health Checker script to identify which cumulative updates your servers are running and whether they are eligible for the V2 update.
• Verify ESU enrollment if you are on Exchange 2016 or 2019. Without Period 2 ESU, the update will not be available to you, and you should accelerate your migration planning.
• Use the Exchange Update Wizard to determine the correct upgrade path for your specific configuration.
• Reboot affected servers after installation and verify that all Exchange services start successfully.
• Monitor for anomalous mailbox access in your environment. Even though Microsoft has not observed active exploitation, the window between patch release and widespread deployment is when attackers are most aggressive in developing exploits.

For organizations that cannot patch immediately, enhanced monitoring of mailbox access logs and tightening of authentication controls — including enforcing multi-factor authentication for all Exchange users — can serve as partial mitigations while the update is tested and deployed.

The broader takeaway is familiar but bears repeating: on-premises Exchange Server remains a high-value, high-risk target. Every month without patching widens the attack surface, and every out-of-band emergency update is a reminder that the threat landscape does not wait for scheduled maintenance windows. Organizations still running Exchange on-premises should be actively planning their migration path to Exchange Online or a supported hybrid configuration — not just patching, but reducing the footprint that needs patching in the first place.