Microsoft Issues Emergency Patch for Critical Exchange Server Vulnerability (CVE‑2026‑96940)

Microsoft released out‑of‑band security updates on Tuesday to fix a high‑severity flaw in its Exchange Server product that could allow an attacker with valid credentials to read the mailboxes of other users.

The vulnerability, identified as CVE‑2026‑96940, carries a CVSS score of 8.8, placing it in the “high” category. Security researchers say the bug enables privilege escalation when certain conditions are met, allowing an authenticated user to impersonate other accounts.

Exploitation requires the attacker to already possess a legitimate Exchange login. Once that foothold is established, the flaw can be leveraged to query mailbox data belonging to other users, potentially exposing confidential communications, attachments, and internal business information.

Exchange Server powers the email infrastructure of countless midsize and large enterprises worldwide, making any weakness in the platform a significant concern. The decision to issue an out‑of‑band update, rather than waiting for the regular Patch Tuesday cycle, signals the perceived urgency of the threat.

Microsoft’s advisory urges all organizations running supported versions of Exchange to apply the patches without delay. Administrators are also advised to review authentication logs for unusual activity and to enforce multi‑factor authentication where possible to reduce the risk of credential compromise.

The fix arrives in the wake of several high‑profile Exchange exploits disclosed over the past few years, including the ProxyLogon and ProxyShell attacks. Those incidents highlighted how vulnerable on‑premises mail servers can become a gateway to broader network infiltration.

Security firms are monitoring threat‑intel feeds for signs of active exploitation of CVE‑2026‑96940. Companies that have not yet updated are encouraged to test the patches in a controlled environment before deployment, while also considering additional hardening measures such as limiting mailbox access permissions.