Exchange Server CVE-2026-62914

Exploitation requires the attacker to hold a valid low-privilege authenticated account within the target Exchange organization, as confirmed by the CVSS PR:L metric - anonymous or unauthenticated external access is insufficient. A victim user must actively interact with attacker-controlled content as rendered by Exchange's web interface (OWA or EAC), per CVSS UI:R; this interaction could be as simple as opening a malicious email or calendar item. The Exchange deployment must be running one of the four affected cumulative update tracks below their respective patched build numbers. The attack is constrained to the scope of the victim's Exchange session (S:U); lateral movement beyond Exchange requires additional steps. No non-default configuration is required - Exchange's standard web-accessible deployment is sufficient for this attack vector to apply.

The CVSS 3.1 score of 7.3 reflects a High-severity finding with a network attack vector (AV:N), low complexity (AC:L), a low-privilege authentication requirement (PR:L), and required victim interaction (UI:R). The high confidentiality and integrity sub-scores (C:H/I:H) reflect the spoofing potential - a successful attack could harvest session credentials or manipulate content on behalf of the victim. There is no CISA KEV listing and no public exploit code was identified in the provided intelligence, meaning active exploitation is unconfirmed at time of analysis. EPSS data was not included in the source intelligence, limiting probabilistic exploitation forecasting. Despite the absence of confirmed in-the-wild use, Exchange Server is a perennial high-value target, and the low authentication barrier means even a mid-sized municipal IT team in bytom should treat this as urgent patching work rather than deferred maintenance. The UI:R dependency is a genuine risk-limiting factor, but within Exchange's ordinary email and calendar workflows, engineering victim interaction is operationally straightforward for an adversary who already holds a mailbox.

An authenticated low-privilege Exchange account holder crafts a malicious email or calendar invitation containing an XSS payload targeting a vulnerable Exchange web rendering endpoint, then sends it to a higher-privileged user such as an IT administrator. When the victim opens or previews the content through OWA or EAC, the injected script executes in their browser session. The attacker captures the victim's session token or performs spoofed actions - such as sending email on the victim's behalf or accessing mailbox data - without further interaction. No public exploit code has been identified at time of analysis.