Microsoft has launched out-of-band safety updates to deal with a high-severity flaw in Microsoft Alternate Server that would permit an attacker to escalate privileges beneath sure situations.
The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system.
“Weak authorization in Microsoft Alternate Server permits an authenticated attacker to raise privileges over a community,” Microsoft stated in an advisory launched on October 2, 2026.
The Home windows maker stated an authenticated attacker can exploit this flaw to achieve unauthorized entry to different customers’ mailboxes inside the identical group and browse e-mail messages and attachments. Nonetheless, the vulnerability doesn’t permit cross-tenant entry.
Microsoft has already deployed a “associated service-side repair” to Alternate On-line to deal with the problem. Because of this, Alternate On-line prospects should not required to take any motion.
Customers of affected on-premises Microsoft Alternate Server merchandise are suggested to put in the updates to remain protected. The next variations are impacted –
- Microsoft Alternate Server Subscription Version RTM
- Microsoft Alternate Server 2016 Cumulative Replace 23
- Microsoft Alternate Server 2019 Cumulative Replace 15
- Microsoft Alternate Server 2019 Cumulative Replace 14
Redmond has credited Microsoft researcher Jan Mitchell with discovering and reporting the flaw. Though there isn’t any proof of the flaw being weaponized within the wild, Microsoft has tagged it with an Exploitability evaluation of “Exploitation Extra Seemingly,” making it important that customers transfer shortly to use the fixes.
The disclosure comes days after Broadcom-owned Symantec warned that the China-linked Warlock actor is exploiting a number of vulnerabilities in Microsoft SharePoint to deploy its namesake ransomware in assaults concentrating on organizations in Portuguese- and Spanish-speaking nations.
