Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft released out-of-band security updates for a high-severity Exchange Server vulnerability (CVE-2026-96940, CVSS 8.8) that can let an authenticated attacker escalate privileges and read other users' mailboxes within the same organization; Exchange Online received a service-side fix, on-premises customers should apply updates for listed Exchange versions, and Microsoft rates exploitability as "Exploitation More Likely" though no active exploitation has been observed.