CVE-2026-96940: Microsoft Exchange Vulnerability Allows Unauthorized Mailbox Access
ID: dc7231a0-eaab-5cfd-a3df-a61d7b5c3ad4
STIX ID: report--dc7231a0-eaab-5cfd-a3df-a61d7b5c3ad4
Feed Name: SOC Prime Blog
Microsoft released an out-of-band security update for CVE-2026-96940, a high-severity (CVSS 8.8) authorization vulnerability in on-premises Exchange Server that can allow authenticated attackers to access other users’ mailboxes; affected versions include Exchange SE RTM, 2019 CU14/CU15, and 2016 CU23. Microsoft issued patches (October 2, 2026 V2 update) and applied a service-side fix for Exchange Online, recommends immediate patching, monitoring for anomalous mailbox access, and strengthening access controls; no confirmed active exploitation or public PoC has been reported.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.