Out‑of‑band Microsoft Exchange Server Update Fixes High‑Severity Mailbox Access Vulnerability (CVE‑2026‑96940)
What It Is — Microsoft disclosed CVE‑2026‑96940, a high‑severity flaw in on‑premises Exchange Server that lets an authenticated user read the mailboxes and attachments of other users in the same tenant. The issue does not allow cross‑tenant access.
Exploitability — No public evidence of active exploitation, but the vulnerability is considered consistently exploitable by an attacker who already has valid credentials. Assigned CVSS v3.1 score: 7.5 (High).
Affected Products — Exchange Server Subscription RTM, Exchange Server 2019 cumulative updates 14 and 15, and Exchange Server 2016 cumulative update 23. The out‑of‑band update (September 2026 v2) is available for all listed versions.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The bug bypasses intra‑tenant segregation, highlighting the need for strict identity‑based access policies and continuous verification that permissions match business intent.
- Patch‑management rigor – An out‑of‑band release signals that timely remediation is a control evidence point auditors will scrutinize; delayed patching erodes the defensible audit trail.
- Defensible evidence – Demonstrating that the update was applied, logged, and validated provides concrete proof of due‑diligence for frameworks that require documented remediation (e.g., NIST CSF 2.0).
Recommended Actions
- Deploy the September 2026 v2 security update on all affected Exchange servers and on any workstation running Exchange Management Tools.
- Verify the installed version via the Exchange Management Shell and retain the KB article as evidence of remediation.
- Review mailbox access ACLs to ensure least‑privilege principles; log successful and failed mailbox reads for continuous monitoring.
- Capture the patch‑deployment logs in your control‑mapping repository to satisfy audit requirements.
Source: Help Net Security article