Managing corporate email servers requires continuous vigilance, particularly when critical vulnerabilities emerge. Microsoft has recently released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server. Tracked as CVE-2026-96940, this vulnerability carries a CVSS score of 8.8 and highlights the ongoing challenges organisations face when securing public-facing email infrastructure.
Understanding the nature of this security flaw, its potential impacts, and the broader infrastructure considerations can help your organisation maintain a resilient cybersecurity posture.
Understanding CVE-2026-96940: Authentication vs Authorisation
To understand this vulnerability, it is helpful to distinguish between authentication and authorisation. Authentication verifies who a user is when logging into a system, whereas authorisation determines what files, folders, or mailboxes that user is allowed to access once inside.
CVE-2026-96940 is a weak authorisation flaw in Microsoft Exchange Server. It allows an already authenticated attacker, such as a compromised user account on your network, to elevate privileges over a network. Once elevated, an attacker could gain unauthorised access to other users’ mailboxes within the same organisation, reading private email messages and attachments. While the vulnerability does not allow cross-tenant access between different organisations, the exposure of internal communications presents a significant risk to data privacy and confidentiality.
Microsoft has tagged this vulnerability with an exploitability assessment of “Exploitation More Likely.” Although active exploitation in the wild was not reported at initial disclosure, the potential for rapid weaponisation means timely remediation is vital.
Affected Versions and Remediation Requirements
The security flaw impacts several on-premises Microsoft Exchange Server deployments, including:
- Microsoft Exchange Server Subscription Edition RTM
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 15
- Microsoft Exchange Server 2019 Cumulative Update 14
For organisations relying on Exchange Online, Microsoft has deployed a server-side fix. Consequently, cloud-only Exchange Online customers do not need to take manual administrative action for this specific issue. However, for organisations operating on-premises Exchange servers, system administrators should apply the security updates without delay.
On-Premises Infrastructure versus Cloud Migration
This incident highlights a broader strategic topic for IT leadership: the security and maintenance costs associated with self-hosted, publicly accessible servers.
Securing on-premises email infrastructure against constantly evolving threats requires dedicated internal resources, continuous patch deployment, and rigorous security auditing. Managing these systems effectively can cost hundreds of thousands or even millions of dollars annually in software licensing, infrastructure maintenance, and specialised security personnel.
For many organisations, migrating to managed cloud platforms such as Microsoft Office 365 or Google Workspace can offer enhanced baseline security and operational convenience. Cloud providers automatically apply security patches and server-side mitigations, reducing the administrative burden on internal teams.
At the same time, shifting entirely to major cloud platforms introduces vendor concentration considerations. When a vast majority of businesses rely on a small number of cloud providers, any service disruption or platform-wide issue can have widespread systemic effects. Balancing these trade-offs requires careful evaluation of your organisation’s risk tolerance, compliance obligations, and financial resources.
Practical Steps to Enhance Email Security
Whether your organisation utilises on-premises systems or cloud services, maintaining robust email security involves several key practices:
- Apply Security Updates Promptly: For on-premises deployments, prioritise the installation of Microsoft’s security updates for CVE-2026-96940 to help prevent unauthorised privilege elevation.
- Review Access Control Policies: Regularly audit mailbox delegation, administrative rights, and user access permissions to ensure the principle of least privilege is strictly enforced.
- Enforce Multi-Factor Authentication: Implementing strong multi-factor authentication across all email accounts can help prevent initial account compromise, rendering internal authorisation attacks far harder to execute.
- Conduct Periodic Penetration Testing: Technical security assessments and penetration tests can help identify authorisation weaknesses, misconfigurations, and unpatched systems before malicious actors exploit them.
- Monitor Infrastructure Logs: Continuous monitoring of server access logs and user activities can assist in detecting unusual access patterns or unauthorised privilege escalation attempts early.
How Vertex Can Help
Ensuring your email platforms and corporate infrastructure remain secure against complex vulnerabilities requires expertise and constant attention.
At Vertex Cyber Security, we offer independent security audits, penetration testing, and comprehensive risk management services tailored to your business needs. Whether you are seeking to harden your on-premises servers, evaluate cloud security configurations, or align with international security standards, our team of experts is ready to assist.
To learn more about strengthening your security posture or to discuss your specific requirements, please contact the team at Vertex Cyber Security today.