Project
Exchange Online is Microsoft's cloud-hosted email and calendaring service within Microsoft 365, used by organizations for business mail infrastructure.
Microsoft will block .msix and .msixbundle attachments by default in Outlook on the web and the new Outlook for Windows from early November. Tenants that still mail app packages need a policy exception before general availability in mid-November.
Reality
Microsoft shipped 22 updates, six of them scored 10.0, mostly in Entra ID, Exchange Online and Azure. Fixed server-side is not the same as verified in your tenant.
Reality
Microsoft issued an out-of-band Exchange Server fix for CVE-2026-96940, a bug letting signed-in attackers read colleagues' mail and attachments. The company expects the flaw to be consistently exploitable, so on-premises admins have good reason to install it ahead of the next maintenance window.
Perspective Coverage
3 publishersReality
Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.
Reality
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
Microsoft's initial read on EX1467029 blames its own anti-spam protections for part of the impact, and with no root cause, region list or fix time in the alert, queue depth is the only scoping signal admins have.
Reality
Two Teams faults are open at once: Mac users cannot join calls, and Windows clients can take up to two minutes to launch. With the code-change theory withdrawn, there is nothing to plan a fix date around.
Reality
ReliaQuest's tests show Exchange Online accepts unauthenticated mail when the visible From header matches the tenant domain and the SMTP envelope sender is left empty. Forty percent of those messages went to senior leaders.
Reality
Microsoft traced the failure to recent changes it had made to the service and spent the day testing whether reverting them would help. For anyone mapping dependencies, it was a cheap rehearsal.
Reality
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality