Microsoft Exchange flaw allows hackers to read mailboxes across an organization, so patch now
- Microsoft issues fix for CVE-2026-96940, a high-severity Exchange privilege-escalation flaw
- Attackers with compromised user credentials could access other employees’ mailboxes and emails
- No active exploitation reported, but Microsoft labeled the vulnerability “exploitation more likely"
Microsoft has pushed an urgent update for Exchange Server which fixes a high-severity flaw that could wreak some serious havoc among email users.
The company patched CVE-2026-96940, a “weak authorization in Microsoft Exchange Server [that] allows an authenticated attacker to elevate privileges over a network,” as per the National Vulnerability Database (NVD).
According to Microsoft’s advisory the bug, which was given a severity rating of 8.8/10 (high), can be abused to gain unauthorized access to people’s inboxes within the same organization.
In theory, threat actors who obtained credentials of a low-privileged Exchange user could exploit CVE-2026-96940 to escalate their privileges within Exchange, and then read confidential emails and attachments belonging to other people working for the...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
