AI Weekly Malaysia

Microsoft released out-of-band updates for CVE-2026-96940, a CVSS 8.8 weak-authorization flaw in Exchange Server that lets an authenticated attacker escalate privileges and read other users' mailboxes and attachments within the same organization, though not cross-tenant. Affected on-prem builds include Exchange Server Subscription Edition RTM, 2016 Cumulative Update 23, and 2019 Cumulative Update 14 and 15; Exchange Online has a service-side fix and customers need no action. Microsoft tagged exploitability as 'Exploitation More Likely' and credited Jan Mitchell with reporting, but says there is no evidence of in-the-wild exploitation.

Why: If your organization runs any listed on-prem Exchange build, apply the out-of-band update now because Microsoft rates exploitation as 'Exploitation More Likely' and an authenticated user in the same org could read other mailboxes. If you are only on Exchange Online, Microsoft says the service-side fix is already deployed and no action is required, so app developers using Microsoft 365 mail APIs do not need to change code.