Admins managing Microsoft Exchange servers must quickly install an update that Microsoft released over the weekend. It closes a privilege escalation vulnerability in the mail server, which Microsoft considers rather likely to be exploited. The vulnerability narrowly misses being classified as a critical security risk.
The Exchange team also published a blog post on Microsoft’s Techcommunity . The security updates are available for Exchange SE RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. For the older servers, subscription to the second phase (Period 2) of the Extended Security Update Program (ESU) is required. The update fixes another vulnerability that the September Patchday updates did not address. Due to weak authorization in Microsoft’s Exchange Server, authenticated attackers from the network can escalate their privileges. The developers state that malicious actors can thus gain unauthorized access to other users' mailboxes and read emails and attachments. However, tenant boundaries cannot be overcome (CVE-2026-96940, CVSS 8.8 , Risk “ high ”).
However, the update also has side effects, which Microsoft mentions in the blog post. Published calendars may return HTTP 500 server errors in calendar applications. The so-called ContentEngine can get stuck (deadlock) due to missing word separation rules for Korean. Microsoft plans to fix these issues with a future update. However, there are also resolved issues: for example, messages sent on behalf of shared mailboxes could appear in the inbox of that account – programmers have fixed this. The availability (free/busy) of delegated mailboxes in hybrid Exchange environments could not be set correctly when using the Graph API; this is also a thing of the past.
Microsoft provides further guidance in the FAQ section of the blog post. In hybrid environments, Microsoft has already taken care of patching the cloud servers; however, admins must update the on-premises servers themselves. Additionally, the developers recommend installing the updates on Exchange instances used solely as management tools.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
