CVE-2003-0904: Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not...

Security readout for executives and security teams

This vulnerability can cause Outlook Web Access users to see another person’s mailbox under a specific legacy configuration. The risk is unauthorized email disclosure, not system takeover. It applies to Microsoft Exchange 2003 OWA using NTLM when Kerberos is disabled for IIS 6.0. Exposure is limited to legacy Microsoft Exchange 2003 Outlook Web Access deployments using NTLM authentication with Kerberos disabled on IIS 6.0. The CVE description notes SharePoint Services 2.0 as an example condition that may disable Kerberos. Prioritize urgently if any Exchange 2003 OWA remains in production or exposed to users. The business impact is cross-user mailbox disclosure, which can expose confidential communications even without code execution. Mitigation focus: Review and apply Microsoft MS04-002 guidance for Exchange 2003 OWA systems.; Confirm OWA authentication configuration does not match the vulnerable NTLM-only condition.; Check Microsoft Exchange OWA support guidance before changing IIS authentication settings..

Prepared

Jun 30, 2026, 07:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.