Critical Exchange Server Vulnerability Enables Cross-Mailbox Access
Microsoft disclosed CVE-2026-96940, a high-severity privilege escalation vulnerability in Exchange Server with a CVSS score of 8.8. The flaw allows authenticated attackers to exploit weak authorization controls to gain unauthorized access to other users' mailboxes within the same organization, enabling them to read email messages and attachments. Microsoft has already deployed server-side fixes for Exchange Online customers, while on-premises Exchange Server users must apply security updates immediately. The vulnerability affects Exchange Server Subscription Edition RTM, Exchange Server 2016 CU23, and Exchange Server 2019 CU14-15. This incident highlights the growing trend of attackers targeting email infrastructure through privilege escalation techniques, particularly as organizations increasingly rely on hybrid cloud environments. With Microsoft rating the exploitability as 'More Likely,' this vulnerability represents the type of authentication bypass attacks that have become prevalent in 2026's threat landscape.
Kill Chain
