On October 5, 2026, Microsoft released the out-of-band security update “September 2026 v2” for on-premises Exchange Server. It closes CVE-2026-96940, a flaw that lets an employee read the emails and attachments of colleagues.

Microsoft rates the flaw as important. According to researchers, its severity is 8.8 out of 10 on the CVSS scale.

What we know about the Exchange Server flaw

  1. Who can use it. Anyone with a valid account in the organization: an employee, a contractor or an attacker who has stolen one employee’s password.
  2. What they get. Access to the mailboxes of other users in the same organization, that is, to emails and attachments of managers, accountants and lawyers. However, the flaw gives no access to other organizations.
  3. Which servers are at risk. Only on-premises servers:
    • Exchange Server Subscription Edition RTM;
    • Exchange Server 2019 CU14 and CU15;
    • Exchange Server 2016 CU23.
  4. Exchange Online needs no action. Microsoft has already applied the fix on its side.
  5. No attacks so far. Microsoft specialists found the flaw themselves. Still, the company considers exploitation “more likely” and recalls that attackers have used similar flaws before.

Why it matters

Email remains the main channel for business correspondence: contracts, invoices, personal data and internal decisions. Because of this flaw, it is enough to hack one account to reach the mail of the whole organization.

This is especially dangerous in Ukraine. According to CERT-UA, social engineering and phishing caused 31% of cyber incidents in the first half of 2026, and malware caused another 33%. So stealing an ordinary employee’s password is not a problem for an attacker.

Microsoft advises installing the update on all Exchange servers and also on all servers and workstations with Exchange Management Tools. Otherwise, compatibility problems may occur between them.

Read also: Hackers attack Cisco email gateways through attachments; CISA adds five old vulnerabilities to the KEV catalog; Ransomware in 2026: what the new Bitdefender report shows.

How S-byte can help protect your Exchange Server mail

  • Exchange Server updates. We check versions and install updates on servers and management tools within an agreed maintenance window.
  • Access audit. We check who can access which mailboxes and look for excessive rights and signs of unauthorized reading.
  • Multi-factor authentication (RSA Security). A stolen password alone no longer opens the account. S-byte has already confirmed TPI compliance of RSA ID Plus E3.
  • Phishing and malware protection. We deploy cybersecurity solutions from our vendor partners to protect mail and workstations.
  • Technical support with SLA. We follow security advisories and install critical updates on time, without reminders.
  • Cloud solutions and data protection. We help you decide whether to move mail to the cloud and set up data backups.

If your organization runs its own Exchange server, do not delay the update. Contact S-byte, and we will check your mail server and help protect it.