Our takeMicrosoft's out-of-band update fixes CVE-2026-96940 in on-prem Exchange Server, letting authenticated users inside the same org read others' mail. Patch now if you run Exchange Server yourself.Cyber Resilience desk
Sources (2)
- govcert_hk · govcert_hk
- helpnet · helpnet
What this means for you — Security leader:Apply the out-of-band Exchange update immediately on all on-prem servers; the bug lets authenticated users read other mailboxes in the same organization.
What this means for you — Lean IT orgs:If you run your own Microsoft Exchange Server, install Microsoft's emergency update right away — it stops people inside your company from reading emails they shouldn't see.
What this means for you — MSP:Deploy the out-of-band Exchange patch across all managed on-prem instances; CVE-2026-96940 allows authenticated intra-org mailbox access but does not cross tenant boundaries.
What this means for you — Researcher:Review the internal-discovery root cause and patch diff for CVE-2026-96940 once Microsoft publishes the security update details.