Microsoft brings forward Exchange updates for same-organisation mailbox access flaw
Microsoft has released ahead-of-schedule security updates for an Exchange Server vulnerability that could let an authenticated attacker access other users’ mailboxes within the same organisation.
The company disclosed CVE-2026-96940 and issued its September 2026 V2 Exchange Server updates on 2 October. Microsoft said it was not aware of exploitation at disclosure, although it assessed future exploitation as more likely.
The V2 packages followed the original September Exchange Server security updates, released on 8 September. The 2 October disclosure supplied the CVE details and branch-specific fixed builds, while the Exchange team said the V2 release had been brought forward from its intended schedule.
The distinction matters. The update responds to a vulnerability and a forecast about its potential use, not evidence of an active hacking campaign. No confirmed victim, data access or exfiltration linked to the flaw was established in the sources reviewed through 7 October.
What the Exchange flaw allows
Microsoft describes CVE-2026-96940 as an elevation-of-privilege vulnerability caused by weak authorisation in Exchange Server. An attacker must already be authenticated and able to reach the server over a network.
Authentication limits who can attempt exploitation, but it does not confine the potential impact to the mailbox associated with that account. According to Microsoft, successful exploitation can provide unauthorised access to other users’ mailboxes in the same organisation, including their email messages and attachments.
Microsoft says the vulnerability does not allow cross-tenant access. It also has not published the vulnerable component or a detailed account of the exploitation process, so the available information does not support claims about how an attacker might first obtain valid authentication.
Microsoft rates the vulnerability Important. Its CVSS 3.1 base score is 8.8, which falls in the High band. Although an authenticated flaw may be ranked differently from an unauthenticated remote-code-execution vulnerability, the prerequisite does not remove the confidentiality risk once a valid account is under an attacker’s control.
Which Exchange branches need updates
The affected on-premises branches and their corresponding fixed builds are:
Exchange Server Subscription Edition RTM: SU10V2 in KB5129955, build 15.02.2562.053.
Exchange Server 2019 CU15: SU11V2 in KB5129956, build 15.02.1748.053.
Exchange Server 2019 CU14: the V2 security update in KB5129957, build 15.02.1544.048.
Exchange Server 2016 CU23: SU25V2 in KB5129958, build 15.01.2507.075.
Administrators need to match the update to the installed branch rather than infer the position of older cumulative updates from this list. Microsoft brought the V2 release forward from its intended schedule, but it has not publicly explained that timing beyond the disclosed vulnerability and its exploitability assessment.
Exchange Online is handled differently
Microsoft applied a related service-side fix to Exchange Online. Customers using the cloud service do not need to install an update for this CVE.
That position does not remove the need to check on-premises Exchange servers retained in an organisation, including listed branches used in hybrid environments. The affected on-premises software requires the relevant administrator-installed package even where other mail services are hosted online.
Microsoft recommends running Exchange Server Health Checker after installation. This verifies whether the update succeeded and can identify further actions that may be required. Confirming the resulting build is important because the fixed state is specific to each Exchange branch.
Known issues require branch-specific checks
Microsoft’s support pages document known issues for the Subscription Edition RTM and Exchange Server 2019 CU15 packages. Both KB5129955 and KB5129956 say published calendar .ics requests can return an HTTP 500 response.
KB5129955 also lists delegated-mailbox free and busy failures in some Graph-only hybrid deployments, along with a ContentEngine deadlock associated with missing Korean WordBreaker rule files. Those additional issues are documented for that package and should not be generalised to Exchange 2019 CU14 or Exchange 2016 CU23 without branch-specific information.
The known issues make post-installation validation part of the update process rather than an optional final check. Administrators should consult the applicable Microsoft support page and use Health Checker for the branch they operate.
The end-of-support deadline
Exchange Server 2016 and 2019 are out of support. Microsoft says organisations enrolled in Period 2 Extended Security Updates can receive security updates released through the end of October 2026. Update access depends on an organisation’s eligibility and enrolment.
Microsoft directs organisations outside that arrangement to migrate to Exchange Server Subscription Edition. For operators still running Exchange 2016 or 2019, CVE-2026-96940 therefore presents two related tasks: deploying the available fix where entitled and addressing the approaching end of the stated ESU window.
Microsoft’s forward-looking assessment supports prioritising the update, but it should not be mistaken for confirmation that attacks have begun. The immediate practical distinction is between Exchange Online, where Microsoft completed the service-side work, and listed on-premises branches, where administrators must install the correct update, verify the fixed build and check for package-specific issues.
Separating authentication from authorisation helps explain why a valid account does not settle which resources should be reachable. If you want to explore the wider concepts behind that distinction, The Hack Academy’s online cybersecurity training programme offers self-paced study in cybersecurity fundamentals and networking, pairing theory with practical exercises.
