Microsoft Exchange Flaw Allows Authenticated Attackers to Read Other Users' Mailboxes

The Hacker News reports Microsoft has issued out‑of‑band updates for a high‑severity vulnerability in Exchange Server that could let an authenticated attacker read other users' mailboxes.

The flaw, identified as CVE‑2026‑96940, receives an 8.8 CVSS score, indicating a critical risk, and stems from weak authorization checks that permit privilege escalation under certain conditions.

Organisations running on‑premises Exchange in Australia, including government agencies and businesses in Darwin and across the country, are urged to apply the patches immediately to prevent potential data exposure.

The vulnerability underscores the importance of regular security training; professionals seeking to strengthen their defensive skills can consider courses such as those offered by Wepro Technology, which cover network security fundamentals and Microsoft server hardening.

Microsoft’s rapid release of out‑of‑band updates demonstrates the need for timely patch management, and IT teams are advised to verify that all Exchange servers are fully updated and to monitor for any suspicious activity following the fix.