Microsoft Patches On-Premises Exchange Flaw That Can Open Coworkers' Mailboxes

Here Is How Layered Defenses Help

Most email attacks start with one stolen login. The danger of the latest Exchange Server bug is what that one login could become: a window into everyone else’s inbox. Microsoft has released an out-of-band fix, and companies that still run Exchange on their own servers should treat it as a priority.

The flaw, step by step

The bug. CVE-2026-96940 is a weak-authorization flaw in Microsoft Exchange Server, rated 8.8 on the CVSS scale. Microsoft’s advisory was published on October 2, 2026.
What an attacker needs. A valid, authenticated account in the organization. From there, the flaw allows privilege escalation over the network.
What they gain. Unauthorized access to other users’ mailboxes in the same organization, including the ability to read messages and attachments. It does not allow access across tenants.
Who must act. Customers running Exchange Server Subscription Edition RTM, Exchange Server 2016 Cumulative Update 23, or Exchange Server 2019 Cumulative Update 14 or 15 need to install the update.
Who is already covered. Microsoft has applied a related service-side fix to Exchange Online, so cloud customers do not need to do anything.
How urgent it is. There is no evidence of attacks so far, but Microsoft rates the bug “Exploitation More Likely.” Microsoft researcher Jan Mitchell is credited with finding it.

Ravie Lakshmanan summarized the advisory for The Hacker News, including the full list of affected versions.

Why layers matter here

This bug turns a single compromised account into access across the organization. That is exactly the scenario layered security is built for: if one control fails, the next one limits how far the attacker gets. Any products mentioned below are examples only. Comparable tools exist from many vendors, and the right combination depends on your environment.

Layer 1: Patch the server

Install the out-of-band update on every affected Exchange server, and confirm the cumulative update level on each one. Unsupported or forgotten servers are where flaws like this live longest.

Layer 2: Make the first login hard to steal

Since the attacker needs a working account, strong authentication shrinks the risk. Multifactor authentication, ideally phishing-resistant options like passkeys or hardware keys, applied through your identity platform (Microsoft Entra ID or a comparable service), makes stolen passwords far less useful.

Layer 3: Limit who can reach Exchange

Restrict access to Exchange services to the networks and devices that genuinely need it, for example through a VPN, a reverse proxy or conditional access rules.

Layer 4: Watch for mailbox access that doesn’t fit

Turn on mailbox audit logging and review it. One account opening many colleagues’ mailboxes, or reading mail it has never touched before, should trigger an alert.

Layer 5: Have a plan for the day it goes wrong

Know how you would revoke sessions, reset credentials and check which mailboxes were accessed. A short written playbook saves hours during an incident.

What this means for your company

Know which email you run. If you are fully on Exchange Online, Microsoft has handled this one. If any Exchange servers remain on-premises, including hybrid setups, they need the update now.
Treat every account as a possible starting point. Internal access is not the same as trusted access. Design controls on the assumption that one login will eventually be stolen.
Weigh the cost of staying on-premises. Self-hosted Exchange puts patch speed in your hands. If keeping up is a struggle, it may be time to discuss alternatives.

Need help patching, hardening or monitoring your Exchange environment? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.