If your business still runs its own Microsoft Exchange server for email, there is an update you should not leave sitting in the queue.
Microsoft has fixed a high-severity flaw, tracked as CVE-2026-96940, in Exchange Server. It is rated 8.8 out of 10. The fix is included in Microsoft’s September 2026 “V2” Exchange Server security update.
What the flaw does
Microsoft describes it as weak authorisation in Exchange Server that lets an attacker who is already signed in raise their own privileges over the network. In plain terms: if a criminal gets hold of just one staff member’s email login – through a phishing email, for example – this flaw could let them open other people’s mailboxes and attachments within the same organisation.
Think about what sits in your team’s inboxes: invoices, bank details, contracts, payroll and customer information. One stolen password should not unlock all of it.
How urgent is it?
Microsoft says it found the problem itself and has no evidence that anyone is exploiting it yet. However, it has labelled the flaw “exploitation more likely”, and urges administrators to patch promptly. Once a fix is public, attackers can study it to work out how to attack servers that have not been updated.
What to do this week
- Find out where your email lives. If you are not sure whether you use your own Exchange server, ask whoever looks after your IT.
- If you run Exchange Server, install the September 2026 V2 security update and confirm it applied successfully.
- Turn on multi-factor authentication for email, so a stolen password alone is not enough to sign in.
- Remind staff about phishing. This flaw needs a working login first, and phishing is the usual way criminals get one.
Keeping servers patched is one of the simplest and most effective ways to protect your business, but it is also one of the easiest jobs to let slide when everyone is busy.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.