Loading story…
Microsoft disclosed CVE-2026-56191, a critical improper authentication vulnerability in Exchange Online that allowed unauthenticated remote attackers to perform tampering against the hosted service. The flaw, tracked under CWE-287, carries a CVSS 3.1 score of 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating potential impact across confidentiality, integrity, and availability in affected tenants.
According to published advisories, the issue could have enabled unauthorized changes to Exchange Online data or configuration, including mail flow rules, mailbox permissions, compliance settings, and audit configurations. Microsoft said the vulnerability affected Exchange Online only, not on-premises Exchange Server, and remediated it through a backend service update. At the time of publication, no active exploitation had been reported, but organizations were urged to review tenant configurations, privileged roles, forwarding and inbox rules, and audit logs for signs of unauthorized modification.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
As of the referenced publication, no active exploitation of CVE-2026-56191 had been reported. This was stated alongside guidance for defenders to review Exchange Online tenant settings and logs for unauthorized changes.
CVE-2026-56191 was publicly listed as a newly received vulnerability affecting Microsoft Exchange Online, with sources describing it as an improper authentication flaw enabling unauthorized tampering over a network. Public reporting assigned it critical severity, including a CVSS 3.1 score of 10.0 in one reference.
Microsoft addressed CVE-2026-56191 in Exchange Online through a backend service update documented in the Microsoft Security Update Guide. The flaw is an improper authentication issue that could allow unauthenticated network attackers to tamper with Exchange Online data or configuration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple vulnerabilities in on-premises **Exchange Server**, including **CVE-2021-31207** (security feature bypass), **CVE-2021-31209** (spoofing), and **CVE-2022-41040** (elevation of privilege). The issues affected Exchange deployments rather than **Exchange Online**, extending a pattern of high-impact weaknesses in the mail platform that could undermine trust boundaries, enable impersonation, and weaken built-in protections. Among them, **CVE-2022-41040** was rated **Critical** with a **CVSS 3.1 score of 8.8**, and Microsoft said exploitation had been detected in the wild before public disclosure. The flaw required an authenticated attacker with low privileges and no user interaction, and successful exploitation could allow the attacker to run **PowerShell** as **`SYSTEM`**. Microsoft later released security updates and directed Exchange Server customers to apply mitigations and patches for the reported zero-day issues.
Jun 29, 2026
Microsoft released 22 security updates for cloud and enterprise products, including multiple **critical** vulnerabilities with CVSS scores of `10.0` affecting **Azure SQL Database**, **Exchange Online**, **Azure Arc**, **Azure Managed Instance for Apache Cassandra**, and **Entra ID**. The updates also addressed seven additional critical elevation-of-privilege flaws in **Azure SQL Database**, **Microsoft Fabric**, **Entra ID**, **Azure Logic Apps**, and **Azure Data Factory**. Microsoft said most of the issues were mitigated **server-side**, reducing or eliminating required customer action. One of the most severe issues, `CVE-2026-65801`, is an unauthenticated **server-side request forgery** flaw in **Exchange Online** that can lead to unauthorized privilege escalation over the network. The vulnerability affects only the cloud-hosted service and not on-premises Exchange Server, and Microsoft has already deployed mitigations without requiring customer patching. Public reporting cited no confirmed active exploitation or public proof-of-concept at the time of disclosure, but organizations were urged to review Microsoft 365 security and audit telemetry for suspicious authentication, authorization, or administrative activity.
Aug 25, 2026
Microsoft disclosed **CVE-2026-42897**, a high-severity spoofing vulnerability in on-premises **Microsoft Exchange Server** that is being actively exploited in the wild. The flaw stems from improper neutralization of input during web page generation and can be triggered when a user opens a specially crafted email in **Outlook Web Access**, leading to cross-site scripting and arbitrary JavaScript execution in the victim’s browser context. Affected products include **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**; **Exchange Online** is not affected. Microsoft has not yet released a permanent patch for `CVE-2026-42897`, but said it is automatically deploying a temporary mitigation through the **Exchange Emergency Mitigation Service**, which applies a URL rewrite configuration and is enabled by default. For air-gapped or disconnected environments, the company directed administrators to use the **Exchange on-premises Mitigation Tool**, while noting a cosmetic issue may affect mitigation status reporting. Microsoft also published the vulnerability in its Security Update Guide alongside other advisories, including **CVE-2026-41615** for Microsoft Authenticator.
Jun 29, 2026