Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

1. Executive summary

Microsoft released out-of-band updates on 2 October 2026 for CVE-2026-96940, a weak authorization flaw in on-premises Exchange Server that lets any authenticated attacker read other users' mail and attachments inside the same organization. The verified reference data records CVSS 8.8 HIGH, CWE-1390 (weak authentication), EPSS 0%, and no CISA KEV listing. Microsoft's own exploitability assessment is "Exploitation More Likely", and the company states it is not aware of active exploitation, so this is a patch-before-weaponization item rather than an incident. The exposure is on-premises only: Exchange Online received a service-side fix and needs no customer action. For EMEA financial services the risk concentrates in hybrid and on-prem deployments where a single low-privilege mailbox or service account already exists, because the flaw converts that foothold into organization-wide mailbox read access without a second vulnerability.

2. Regulatory framing

No DORA Art. 19 or NIS2 Art. 23 reporting obligation is engaged on current evidence: Microsoft states it is not aware of active exploitation, so there is no confirmed incident to report. If a firm later confirms exploitation, the classification and reporting articles become live.

3. Technical analysis & attack chain

The flaw is a weak authorization check in Exchange Server. Microsoft's advisory describes it as allowing an authenticated attacker to elevate privileges over a network. The practical effect, per Microsoft and corroborated by BSI Germany, is that the attacker gains unauthorized access to other users' mailboxes within the same organization and can read email messages and attachments. Cross-tenant access is not possible, which bounds the blast radius to a single tenant.

Confirmed attack chain:

1. The attacker holds valid credentials for any authenticated account in the target organization. No pre-authentication access is required, and no separate vulnerability is needed to reach this state.
2. The attacker sends requests to the Exchange Server that exploit the weak authorization check on mailbox access.
3. The server returns mailbox content belonging to other users in the same organization, including message bodies and attachments.
4. The attacker reads that content. The sources describe read access to mail and attachments; they do not describe write, delete, or send-as capability, and no source claims it.

Affected on-premises products, as listed by Microsoft:

• Exchange Server Subscription Edition RTM
• Exchange Server 2016 Cumulative Update 23
• Exchange Server 2019 Cumulative Update 15
• Exchange Server 2019 Cumulative Update 14

Exchange Online is not affected by customer action: Microsoft deployed a related service-side fix and states Exchange Online customers need do nothing.

The vulnerability was discovered internally and is credited to Microsoft researcher Jan Mitchell. Microsoft's exploitability assessment is "Exploitation More Likely", which is an assessment of how reliably the flaw can be exploited, not evidence that it has been. Microsoft states it is not aware of active exploitation. The verified reference data records EPSS 0% and no CISA KEV entry, which is consistent with a flaw that is not yet being exploited in the wild.

Two classification discrepancies are worth recording. The verified reference data assigns CWE-1390 (weak authentication), while the GitHub advisory for the Exchange Online variant describes the same class of issue as incorrect authorization; both describe an authorization failure on mailbox access and the difference does not change remediation. The GitHub advisory also names Exchange Online as the affected product, whereas Microsoft's customer-facing guidance is that Exchange Online is already fixed server-side and only on-premises deployments require action.

No payload, malware capability, persistence mechanism, command-and-control channel, lateral movement technique, or exfiltration method is described in any source. The sources describe a server-side authorization flaw that returns mailbox data to an authenticated requester. Any advisory that attributes implant behaviour, ransomware, or a named threat actor to CVE-2026-96940 would be inventing it.

The related sources include coverage of separate Exchange vulnerabilities: CVE-2026-62911, a critical authentication bypass by capture-replay fixed on 11 August 2026 with roughly 22,000 servers still unpatched as of early September 2026, and CVE-2026-42897, an XSS and security policy bypass that Microsoft confirmed was actively exploited. Neither is CVE-2026-96940. They are relevant only as evidence that Exchange estates in this region carry a backlog of unpatched mail-server flaws. The Warlock ransomware reporting referenced in the primary item concerns SharePoint, not Exchange, and is not connected to this CVE.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory on-premises Exchange Server instances and identify which are running Subscription Edition RTM, 2016 CU23, 2019 CU15, or 2019 CU14. These are the affected builds.
• Apply the Microsoft out-of-band update to every affected on-premises server. This is the only remediation for the flaw; there is no configuration workaround described in the sources.
• Confirm Exchange Online requires no action and do not schedule maintenance for it on the basis of this advisory.
• Where a server cannot be patched inside 24 hours, restrict network access to its client-facing endpoints to known management and internal client ranges, and treat the window as a compensating control rather than a fix.

P2 (within 72 hours)

• Review Exchange mailbox audit logs for the period since the last known-good patch state, looking for a single authenticated principal accessing mailboxes it does not own. The sources give no atomic indicators, so this is behavioural review, not signature matching.
• Audit service accounts and low-privilege mail-enabled accounts for unnecessary mailbox permissions, since the flaw requires only an authenticated foothold to reach other mailboxes.
• Confirm with any third party that operates the Exchange estate that the out-of-band update has been applied and that they will notify you of any suspected exploitation.

P3 (within 7 days)

• Fold the affected builds into the standard Exchange patch baseline so that Subscription Edition RTM, 2016 CU23, and 2019 CU14/CU15 do not persist as long-lived versions.
• Reconcile against the CVE-2026-62911 backlog: if the same estate is still unpatched for the August authentication bypass, that is a larger and already-known exposure than this one.
• Verify that mailbox audit logging is enabled across all on-premises mailboxes, so that a future exploitation attempt of this class is visible.

5. Indicators of compromise

No indicators of compromise available in the source material. No hashes, domains, IP addresses, file paths, registry keys, or command lines are given in any source for CVE-2026-96940.

The sources describe observable behaviour but no atomic indicators. The behavioural indicators below are the observable consequences of the flaw as described by Microsoft and BSI Germany; they are not vendor-published detection signatures and should be tuned against each environment's normal mailbox access patterns.

Behavioural indicators

6. Detection

The sources contain no file artefacts, command lines, mutexes, registry keys, or hard-coded values for CVE-2026-96940. There is nothing to build a YARA rule from, and a rule keyed on the CVE identifier or the product name would detect reporting about the flaw rather than the flaw itself.

Insufficient indicators to author detection rules.

Detection effort for this item belongs in log analysis rather than file or process signatures: correlate Exchange mailbox audit events against identity sign-in events to find authenticated principals reading mailboxes they do not own. That is a hunting hypothesis, not a rule, because no source publishes the log fields or event identifiers that would make it deterministic.

CVE assessment

1 referenced CVE

7. Sources

• The Hacker News, Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes, https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html, 2026-10-05
• Help Net Security, Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940), https://www.helpnetsecurity.com/2026/10/05/exchange-server-vulnerability-cve-2026-96940/, 2026-10-05
• GitHub Security Advisories, Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network, https://github.com/advisories/GHSA-phr2-vr74-whpx
• ANSSI France CERT, Vulnérabilité dans Microsoft Exchange Server, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1258/, 2026-10-05
• BSI Germany, Microsoft Exchange Server: Schwachstelle ermöglicht Privilegieneskalation, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3718
• Help Net Security, Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911), https://www.helpnetsecurity.com/2026/09/02/microsoft-exchange-cve-2026-62911-critical-authentication-bypass-flaw/, 2026-09-02
• ANSSI France CERT, Vulnérabilité dans Microsoft Exchange Server (CVE-2026-42897), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0599/, 2026-05-15

8. Adverse Trace position

Adverse Trace assesses CVE-2026-96940 as a high-severity, patch-now vulnerability with no confirmed exploitation: CVSS 8.8 HIGH, EPSS 0%, not in CISA KEV, and Microsoft stating it is not aware of active exploitation, against an exploitability assessment of "Exploitation More Likely". The absence of a KEV listing and a 0% EPSS score mean this is not an emergency incident, but the low bar for exploitation (any authenticated account) and the sensitivity of mailbox content make it a priority for any EMEA financial services firm running on-premises Exchange. Client impact is bounded to the tenant, since cross-tenant access is not possible, and Exchange Online customers are unaffected. The attribution context in the primary item concerns Warlock and SharePoint and has no bearing on this CVE; we make no actor attribution here. We will monitor for a CISA KEV addition, for any vendor reporting of in-the-wild exploitation, and for publication of atomic indicators, and will reissue this advisory if any of those appear. Clients running on-premises Exchange should confirm patch status for the four affected builds and report back to their Adverse Trace contact.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.