Defectus Microsoft Exchange Permittit Authenticated Attackers Legere Alia Usorum Mailboxes

Microsoft emisit updates securitatis extra ordinem ad tractandum defectum altae severitatis in Microsoft Exchange Server, qui permittit impugnatoribus augere privilegia sub certis condicionibus.

Vulnerabilitas, quae ut CVE-2026-96940 notatur, 8.8 in systemate CVSS aestimatur.

"Imbecillis auctoritas in Microsoft Exchange Server permittit impugnatori authentico privilegia super reticulum elevare," in advisoria, quae die 2 Octobris 2026 divulgata est, dixit Microsoft.

Fabricator Windows dixit impugnator authentico hanc vulnerabilitatem explere posse ad accessum non auctoritatum ad alias usorum mailboxes intra eandem organisationem obtinendum et nuntios electronicus et annexa legere. Tamen, vulnerabilitas non permittit accessum trans-tenant.

Microsoft iam "fixum servitii parte relatum" ad Exchange Online ad hanc quaestionem tractandam deployavit. Ut exinde, clientes Exchange Online non tenentur ad ullam actionem capiendam.

Usoribus productorum Microsoft Exchange Server on-premises affectorum suadetur ut updates installent ut protegantur. Sequentes versiones afficiuntur -

Microsoft Exchange Server Subscription Edition RTM

Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft Exchange Server 2019 Cumulative Update 15

Microsoft Exchange Server 2019 Cumulative Update 14

Redmond Jan Mitchell, investigator Microsoft, cum detegendo et referendo defectum credidit. Quamvis nulla evidens sit defectum in natura armata esse, Microsoft id cum aestimatione Exploitability "Exploitation More Likely" notavit, id quod facit ut usores celeriter se moveant ad applicandas solutiones.

Nuntiatio venit dies postquam Symantec, cuius dominus est Broadcom, monuit quod actor Warlock, ad Sinam pertinentem, plures vulnerabilitates in Microsoft SharePoint explere ad ransomware nominis sui in impugnationibus targeting organisationes in regionibus lusitanicis et hispanicis.

Hanc artem interesting invenisti? Sequere nos in Google News, Twitter et LinkedIn ut plura contenta exclusiva legas, quae publicamus.

Vulnerabilitates Relatae

CVE-2026-96940 CVSS 8.8 HIGH Undergoing Analysis

CVE-2026-96940 - Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.

CVE-2026-88772 CVSS 9.5 CRITICAL Analyzed

CVE-2026-88772 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - [Actively Exploited]

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Defectus Microsoft Exchange Permittit Authenticated Attackers Legere Alia Usorum Mailboxes

Vulnerabilitates Relatae

Plura ex The Hacker News