What is the CVSS score of CVE-2026-47631?

CVE-2026-47631 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-47631?

Microsoft Exchange Server is vulnerable to a cross-site scripting flaw (CVE-2026-47631, CVSS 8.1) that enables remote attackers to hijack authenticated user sessions and access mailbox contents after…. A patch is available.

How to fix or mitigate CVE-2026-47631?

Within 24 hours: Inventory all Microsoft Exchange Server instances and verify current versions; check Microsoft Security Update Guide for emergency patches. Within 7 days: Deploy email gateway filtering and URL rewriting to block XSS payloads; enable mailbox and administrator audit logging; restrict external access to Exchange Outlook Web Access if operationally feasible. Within 30 days: Brief all users on risks of clicking unsolicited links in messages; establish daily monitoring of Microsoft security advisories; prepare deployment procedures for immediate patching upon vendor release.

Microsoft Exchange Server CVE-2026-47631

EUVD-2026-35506 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-42jv-fvjf-vjmq

XSS Microsoft Exchange Server

5.4

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

Jun 15, 2026 - 14:22 NVD

8.1 (HIGH) 5.4 (MEDIUM)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:55 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.1

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing via reflected/stored cross-site scripting in Microsoft Exchange Server allows a remote unauthenticated attacker to execute attacker-controlled script in the context of a victim's authenticated Exchange session after the victim interacts with a crafted link or message. With a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R) and high confidentiality and integrity impact, successful exploitation enables session hijacking, mailbox content disclosure, and message manipulation, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The underlying weakness is CWE-79, improper neutralization of user-supplied input during web page generation, in components of Microsoft Exchange Server that render attacker-controllable content (commonly Outlook Web Access / OWA, ECP, or message rendering paths). Exchange Server is Microsoft's on-premises mail and collaboration platform built on IIS and .NET, and XSS in these web surfaces lets injected HTML or JavaScript execute in the browser of an authenticated administrator or mailbox user. Because Exchange web interfaces hold privileged session cookies and Exchange tokens, successful script execution can act on behalf of the victim against the same origin.

RemediationAI

Patch available per vendor advisory - apply the Microsoft Exchange Server security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631 for your installed version and cumulative update, as MSRC is the authoritative source for the exact fix build. Until the update is deployed, reduce exposure by restricting OWA and ECP access to trusted networks or via a reverse proxy with authentication pre-checks, enforcing strict Content Security Policy and HttpOnly/Secure cookie flags where supported, and training privileged users (especially Exchange admins using ECP) to avoid clicking unsolicited Exchange links; note that restricting OWA externally will affect remote mailbox users, and CSP tuning on Exchange can break legitimate add-ins, so test before broad rollout.