CVE-2026-96940: Any Exchange User Can Read Any Other Mailbox, Patch Now
CVE-2026-96940 is a CVSS 8.8 elevation of privilege vulnerability in Exchange Server that lets an already-authenticated user read other users’ mailboxes, emails, attachments, calendars, and contacts, without needing admin rights or any special access first. The bar to exploit this is just an ordinary mailbox login, which makes it meaningfully worse than most Exchange CVEs that require an attacker to already hold elevated access. Microsoft shipped a fix in the September 2026 Exchange Server security updates (V2 release) and Exchange Online customers are already protected server-side, no action needed there. On-premises Exchange Server admins are the ones who need to act.
We don’t run an on-premises Exchange Server in our lab, so the version-check script below is accurate and safe to run in your own environment, it’s provided as a real, runnable script, just not captured as lab output from our own infrastructure.
What’s actually broken
The flaw is a weak authorization check (CWE-1390) in how Exchange validates permission scope on API/EWS requests. When an authenticated user’s client sends a request targeting a specific mailbox, Exchange is supposed to confirm the requester actually has rights to that mailbox before returning data. This check doesn’t correctly validate that scope, so a client can construct a request targeting a different user’s mailbox and get the content back anyway, emails, attachments, calendar entries, contacts, all of it.
The practical risk here is specific and serious: any ordinary employee’s compromised mailbox credentials become a path to reading executive or finance mailboxes directly, not just a foothold that still requires further privilege escalation. That’s a much shorter attack chain than most Exchange vulnerabilities require.
Who’s affected
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Microsoft Exchange Server 2019 Cumulative Update 15
- Microsoft Exchange Server Subscription Edition RTM
Exchange Online is not affected the same way, Microsoft applied a service-side mitigation on the hosted platform already. This is specifically an on-premises Exchange Server problem.
Step 1: check your current Exchange CU and patch level
Get-ExchangeServer | Select-Object Name, AdminDisplayVersion
# Or for the specific build number, which maps to CU + security update level:
Get-Command ExSetup.exe -ErrorAction SilentlyContinue | ForEach-Object {
(Get-Item $_.Source).VersionInfo.FileVersion
}Compare the returned build number against Microsoft’s published build numbers for the September 2026 V2 security update release for your CU. If your build predates that release, you’re exposed.
Step 2: apply the September 2026 V2 security update
Download and install the correct September 2026 V2 security update package for your specific Exchange version and CU from Microsoft’s download center. As with any Exchange cumulative or security update, take a verified backup first, apply it during a maintenance window, and confirm Exchange services start cleanly afterward before considering the server fully patched.
Step 3: review for signs of prior exploitation
Since exploitation here doesn’t require anything beyond an authenticated session, it’s worth reviewing Exchange and EWS access logs for a window before you patch, specifically looking for any account accessing a volume or pattern of mailboxes that doesn’t match its normal usage (a single mailbox suddenly querying many other users’ calendars or message content, for instance). If you find a credible pattern, treat it as a real incident rather than assuming the patch alone resolves it.
Quick guide
- Check your Exchange Server’s current build number against the September 2026 V2 release for your CU.
- If you’re behind, schedule the update with a verified backup beforehand.
- Confirm Exchange services start cleanly after patching.
- Review EWS/Exchange access logs for any account accessing mailboxes outside its normal pattern before the patch went in.
FAQ
Does an attacker need admin rights to exploit this?
No, that’s what makes it serious. Any authenticated mailbox user, including an ordinary employee account, is enough. There’s no requirement for elevated Exchange permissions beforehand.
Do Exchange Online (Microsoft 365) customers need to do anything?
No. Microsoft applied a server-side mitigation to the hosted Exchange Online platform already. This action item is specifically for on-premises Exchange Server.
Has this been exploited in the wild?
Microsoft assessed exploitation as “More Likely” rather than confirming active exploitation at time of disclosure. That assessment is a reason to patch promptly, not a reason to assume you have time to wait.
Is this related to the earlier Exchange Server CVEs covered on this site, like the Visio RCE flaw?
No, it’s a separate, unrelated vulnerability (a different CWE class entirely, weak authorization versus the memory corruption behind a RCE flaw). If you’re running on-premises Exchange, both are worth checking independently, patching one doesn’t cover the other.
