Microsoft has released out-of-band security updates for a flaw in on-premises Exchange Server that could let a logged-in user read other people's email. If your business runs its own Exchange server, it needs patching.

• What it is: A weak authorisation flaw (CVE-2026-96940, rated 8.8 out of 10) that lets an authenticated attacker read other users' emails and attachments within the same organisation.
• Who is affected: Businesses running Exchange Server Subscription Edition, Exchange Server 2019 (CU14 and CU15) or Exchange Server 2016 (CU23) on their own servers. Exchange Online in Microsoft 365 was fixed by Microsoft and needs no action.
• The risk: A compromised staff account, or a rogue insider, could access confidential mailboxes. Microsoft rates exploitation as more likely, although no attacks had been reported at the time of writing.
• What to do: Install the Microsoft security update for your Exchange version as soon as possible, then restart as instructed.

We recommend confirming whether your business still runs an on-premises Exchange server and scheduling the update this week. Contact us if you would like us to check and apply it for you.

Source: The Hacker News