Microsoft Reissues Exchange Server Update to Patch Critical Mailbox Access Flaw
Microsoft has released an updated security patch for Exchange Server to address CVE-2026-96940, a critical vulnerability allowing authenticated attackers to access other users' mailboxes.
Microsoft has reissued its September 2026 security updates for Exchange Server, now designated as the V2 release, to address a critical vulnerability identified as CVE-2026-96940. This flaw, which carries a CVSS score of 8.8, permits authenticated attackers to gain unauthorized access to other users' mailboxes within the same organization. The vulnerability stems from weak authorization controls, enabling an attacker with existing credentials to escalate their privileges and read sensitive email messages and attachments.
Unlike many other vulnerabilities, exploitation of CVE-2026-96940 does not require any user interaction, making it a more direct threat to organizations running on-premises Exchange servers. Microsoft stated that its internal teams discovered the vulnerability and confirmed there was no active exploitation in the wild at the time of disclosure. The company also noted that the updated patch was released ahead of its usual schedule, and some accompanying documentation might have been initially unavailable.
The September 2026 V2 release specifically adds protection against CVE-2026-96940 to the original September security updates. Organizations that had already applied the initial September release must now install the V2 packages to ensure they are protected against this new threat. The affected versions include Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. Administrators are advised to apply the specific package that matches their installed version and cumulative update.
It is important to note that this new vulnerability is distinct from CVE-2026-62911, another Exchange Server flaw previously reported. The existence of a public proof-of-concept for CVE-2026-62911 should not be misconstrued as evidence of an exploit for CVE-2026-96940.
Microsoft has reiterated that Exchange Server 2016 and 2019 are past their end-of-support dates. Security updates for these versions are exclusively available to organizations enrolled in the Period 2 Extended Security Update (ESU) program, which covers the period from May to October 2026 and requires a separate purchase. No further extensions are planned beyond October 2026. Organizations seeking continuous security updates should migrate to Exchange Server Subscription Edition.
Customers using Exchange Online are already protected against the vulnerabilities addressed in this release. However, businesses operating in hybrid environments must still update their on-premises Exchange servers, including those used solely for management purposes. Servers running only Exchange Management Tools also require the relevant updates.
Microsoft recommends utilizing the Exchange Server Health Checker script to identify any missing cumulative updates, security updates, or required manual actions. Administrators should carefully review the deployment guidance before installing the latest security package. After installation, it is crucial to restart the server, verify that Exchange services are functioning correctly, and re-run the Health Checker script to confirm all necessary steps have been completed.
The release notes for the V2 update also mention known issues, including HTTP 500 errors for published calendar files and ContentEngine deadlocks affecting Korean language emails, which Microsoft plans to address in future updates. Fixes for shared mailbox wrapper messages and delegated mailbox availability in hybrid environments are also included. Microsoft strongly urges customers to apply the update promptly to mitigate the mailbox access risk and ensure the continued health of their mail services.
Microsoft has released an out-of-band update for Exchange Server to address CVE-2026-96940, a high-severity vulnerability that allows authenticated attackers within the same organization to read emails and attachments. While Microsoft is not aware of active exploitation, they believe the flaw is consistently exploitable and advise immediate patching for affected on-premise versions, including Exchange Server Subscription RTM, 2019 (CU14, CU15), and 2016 (CU23).
This new report details the specific CVE identifier, CVE-2026-96940, and its CVSS score of 8.8, highlighting that the vulnerability allows authenticated attackers to escalate privileges and read other users' mailboxes within the same organization. It also notes that Microsoft has deployed a service-side fix for Exchange Online, making it unnecessary for those customers to take action, while on-premises users must install the provided updates.