EUVD-2026-73125
GHSA-w4p2-9pm5-wpfw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-reachable pre-auth XSS requiring victim interaction (UI:R); browser-context execution crosses into the authenticated session (S:C) with high confidentiality/integrity but no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an affected, network-reachable Exchange web surface (OWA/ECP on Exchange 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM below the fixed builds) and, critically, user interaction (UI:R) - a victim must open or interact with the attacker-supplied content for the injected script to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly consistent and point to a high-priority server-side issue: AV:N with AC:L and PR:N means the vulnerable endpoint is reachable and cheaply triggered over the network without authentication, and the scope change plus C:H/I:H pushes the score to 9.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for your servicing branch: update to Exchange Server 2016 CU23 build 15.01.2507.073 or later, Exchange Server 2019 CU14 build 15.02.1544.046 or later, Exchange Server 2019 CU15 build 15.02.1748.051 or later, and Exchange Server Subscription Edition RTM 15.02.2562.049 or later, per Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69356 (patch available from vendor). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create a complete inventory of all Microsoft Exchange Server instances to identify which are running versions 2016 CU23, 2019 CU14, CU15, or Subscription Edition RTM, and determine which systems are exposed to external networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today