Microsoft Exchange Server Flaw CVE-2026-96940 Allows Privilege Escalation

Microsoft has released out-of-band security updates to address CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server rated 8.8 on the CVSS scoring system. The flaw involves weak authorization in the server that could allow an authenticated attacker to elevate privileges under certain conditions. Successful exploitation could permit the attacker to read other users' mailboxes, potentially leading to data exfiltration or lateral movement within the organization. The vulnerability affects Microsoft Exchange Server environments globally. Microsoft has not confirmed active exploitation in the wild, but the nature of the flaw raises the risk of targeted attacks. Security updates have been released outside the regular patch cycle to mitigate the risk. Administrators should apply the updates as soon as possible to affected Exchange Server installations. The company recommends reviewing official Microsoft security advisories for detailed guidance on deployment and mitigation.