Microsoft has published out-of-band security updates for a high-severity vulnerability in Microsoft Exchange Server, a flaw that the company says could allow an authenticated attacker to elevate privileges in affected environments under certain conditions. For businesses that still rely on on-premises Exchange, the update is a priority because email remains one of the most sensitive business systems in daily use.

What happened

The vulnerability is tracked as CVE-2026-96940 and has a CVSS score of 8.8. According to Microsoft’s description, the issue involves weak authorization in Microsoft Exchange Server and could allow an authenticated attacker to gain elevated privileges over a network.

Microsoft released the fix as an out-of-band update, which usually means the company considered the issue important enough not to wait for the next regular patch cycle. Based on the information available, the attacker would need to be authenticated first, so this is not described as an unauthenticated remote takeover. However, that does not remove the risk for businesses, especially where compromised accounts, reused credentials or internal access are possible.

Why it matters for European businesses

For many European organisations, Exchange remains a core part of business communication, internal coordination, contracts, customer conversations and regulated record-keeping. If an attacker can move from a basic authenticated position to elevated permissions, the practical outcome may include access to mailboxes that were not intended to be accessible.

This matters for several reasons:

• Email often contains sensitive business data, including invoices, HR information, legal documents, supplier discussions and customer records.
• Mailbox access can support broader attacks, such as internal phishing, business email compromise, password reset abuse or lateral movement into other systems.
• Regulated sectors face added exposure if mailbox contents include personal data, financial information or confidential operational material.
• Authenticated attack paths are realistic when credentials have already been stolen through phishing, infostealer malware, password reuse or compromised VPN and remote access accounts.

For organisations subject to GDPR, a mailbox compromise may also raise data protection and incident response questions, depending on what data was exposed and whether personal information was involved. The source material does not state that exploitation automatically leads to a reportable breach, but businesses should assess that risk if they discover suspicious activity.

Who may be affected

The issue is most relevant to organisations running Microsoft Exchange Server on-premises. This includes SMEs, larger enterprises, public-sector bodies and regulated organisations that maintain their own email infrastructure rather than relying fully on cloud-hosted email services.

Groups likely to be most concerned include:

• IT teams responsible for Exchange administration, patching and identity security.
• Founders and business owners in companies where a small IT team manages critical infrastructure with limited maintenance windows.
• Regulated businesses that store sensitive personal, legal or financial communications in email.
• Digital agencies and service providers that manage Microsoft environments for clients.

Businesses that have already migrated away from on-premises Exchange may have lower direct exposure, but mixed environments and legacy systems should still be reviewed carefully.

What companies should consider

Companies using Microsoft Exchange Server should review Microsoft’s security guidance and determine as quickly as possible whether their environment is affected. Practical steps may include:

• Apply the out-of-band security update promptly following normal change-management and backup procedures.
• Verify which Exchange versions and servers are in scope, including secondary or less-visible systems in hybrid environments.
• Review authentication security, especially for administrator accounts, remote access pathways and any accounts with broad mailbox permissions.
• Check for signs of suspicious mailbox access, privilege changes or unusual internal activity, particularly if the organisation has recently dealt with phishing or credential theft.
• Reassess access controls to reduce the chance that a compromised user account can be used as a stepping stone to wider email access.
• Prepare incident-response steps in case logs or alerts suggest unauthorised access to mailbox data.

For SMEs, the key point is operational rather than theoretical: an authenticated Exchange flaw can become a serious business risk if attackers already have a foothold. Where on-premises email is still in use, patching speed, credential protection and log review are likely to matter more than waiting for a routine maintenance cycle.