AI Weekly Malaysia

Microsoft released out-of-band updates for CVE-2026-96940, a CVSS 8.8 weak-authorization flaw in Exchange Server that lets an authenticated attacker escalate privileges and read other users' mailboxes and attachments within the same organization, though not cross-tenant. Affected on-prem builds include Exchange Server Subscription Edition RTM, 2016 Cumulative Update 23, and 2019 Cumulative Update 14 and 15; Exchange Online has a service-side fix and customers need no action. Microsoft tagged exploitability as 'Exploitation More Likely' and credited Jan Mitchell with reporting, but says there is no evidence of in-the-wild exploitation.

Why: If your organization runs any listed on-prem Exchange build, apply the out-of-band update now because Microsoft rates exploitation as 'Exploitation More Likely' and an authenticated user in the same org could read other mailboxes. If you are only on Exchange Online, Microsoft says the service-side fix is already deployed and no action is required, so app developers using Microsoft 365 mail APIs do not need to change code.

The U.S. State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national charged in Houston federal court over the 2021 HAFNIUM attacks on Microsoft Exchange Server. The nine-count indictment dates from November 2023 and was unsealed in July 2025; the alleged intrusions ran February 2020 to June 2021, and co-defendant Xu Zewei was arrested in Milan in July 2025 and extradited to the U.S. in April 2026. Zhang, described in the indictment as a director at Shanghai Firetech Information Science and Technology who worked on tasks assigned by the Shanghai State Security Bureau, remains at large and the charges are untested in court. The $10 million figure and wording match an offer the program was already making in January 2025.

Why: This is an enforcement and bounty update, not a new vulnerability, tool, or patch — the text contains no new indicators of compromise, no CVE, and no affected-version detail, so there is nothing here to change in a build, deploy, or dependency pipeline this week. The only concrete hook is historical: the HAFNIUM campaign abused Microsoft Exchange Server between February 2020 and June 2021, so if you still run on-prem or hybrid Exchange, treat this as a reminder to verify you are actually patched for that era of Exchange flaws rather than as a reason to act on this article. For everyone else — app developers, AI/agent builders, SaaS founders on cloud-managed mail — the practical decision is to file it under policy news and not spend a sprint on it.