Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
Is Exchange Online affected, and do Exchange Online customers need to take action?
Microsoft has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take any action to receive the fix. Customers using affected on-premises Microsoft Exchange Server products should install the applicable security updates listed in the Security Updates table.
Please see the Exchange blog for more information.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An authenticated attacker who successfully exploited this vulnerability could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments. The vulnerability does not allow access across tenant boundaries.
Security updates
15.02.1544.048 — https://support.microsoft.com/help/5129957
15.01.2507.075 — https://support.microsoft.com/help/5129958
15.02.2562.053 — https://support.microsoft.com/help/5129955
15.02.1748.053 — https://support.microsoft.com/help/5129956
Vulnerabilities 1
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss