Cybersecurity researchers say a new zero-day vulnerability in Microsoft Exchange Server is being actively exploited to break into email accounts tied to several government agencies in Europe and the Middle East. The attacks appear to be aimed at stealing sensitive correspondence rather than causing visible disruption, making the campaign harder to detect.

The flaw affects widely used email infrastructure, which can expose internal communications, credentials, and other confidential material if left unpatched. Researchers described the activity as sophisticated and warned that government networks are likely attractive targets because they often contain high-value intelligence and policy information.

Microsoft and security teams have urged affected organizations to apply mitigations and review systems for signs of compromise. With the vulnerability already under active exploitation, defenders are racing to close the gap before attackers can widen access or move deeper into connected networks.

The incident adds to mounting pressure on public institutions to harden their digital defenses as state-linked and criminal groups continue to target core communication systems. For agencies handling sensitive data, even a limited email breach can have lasting operational and diplomatic consequences.