CoinMeta Data: A vulnerability (CVE-2026-96940) exposes confusion in enterprise authentication, allowing those with access to open "every door." Microsoft's security update (V2) released in September 2026 was described as "a bit strange." This vulnerability has a severity score of 8.8 and is classified as an unauthorized access issue (CWE-285), permitting authenticated attackers to access the emails of other users within the same organization. The vulnerability affects versions Exchange Server SE RTM, 2019 CU14, 2019 CU15, and 2016 CU23. Microsoft categorized it as "more likely to be exploited," based on past instances where similar vulnerabilities have been misused for malicious purposes. The deployment of this update was accompanied by confusion; users (Exchange Online) were patched later last week without prior notice, leading to a surge in activity on platforms such as Reddit. Security teams must audit the integration of identity management systems to ensure that the binding between authentication and authorization is properly verified.