Microsoft Exchange Server EUVD-2026-100137

Exploitation requires an attacker to deliver crafted input to an Exchange Server web-generation surface (such as Outlook on the web / OWA or the Exchange admin interface) and requires the targeted user to interact by rendering that content (UI:R in the vector), so it cannot be triggered silently or automatically. No authentication is required of the attacker (PR:N), making it unauthenticated and network-reachable, but the dependence on victim interaction and on the user possessing access to the affected Exchange web interface are the principal limiting factors. The condition is inherent to the XSS flaw rather than a non-default feature toggle; any Exchange deployment running a version below the fixed builds (2016 CU23 <15.01.2507.077, 2019 CU14 <15.02.1544.050 / CU15 <15.02.1748.055, or Subscription Edition RTM <15.02.2562.056) that exposes the vulnerable web surface is affected.

This is a network-exploitable (AV:N) stored/reflected cross-site scripting flaw (CWE-79) in Microsoft Exchange Server carrying a high CVSS base score of 9.3, driven by low attack complexity (AC:L), no required privileges (PR:N), a changed scope (S:C), and high confidentiality and integrity impact (C:H/I:H). The score is elevated mainly by the scope change and dual H impacts; however, the real-world signals temper this: CISA's SSVC decision framework records Exploitation as 'none' and Automatable as 'no', and no CISA KEV listing or public proof-of-concept is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The CVSS vector requires user interaction (UI:R), meaning an attacker cannot act fully autonomously - a victim must be induced to render the malicious content - which is consistent with the SSVC 'not automatable' judgment and lowers practical urgency relative to the headline 9.3. A notable tension exists between the stated outcome and the impact metrics: the description characterizes the result as 'spoofing,' which is typically an integrity/UI-deception outcome, yet the vendor vector asserts C:H and I:H; treat the confidentiality claim cautiously and verify the concrete impact with Microsoft's MSRC advisory. Net assessment: a credible, patch-worthy Exchange vulnerability that warrants prompt remediation given Exchange's exposure and value as a target, but current evidence points to no active or automatable exploitation rather than an emergency in-the-wild scenario.

An unauthenticated attacker crafts a malicious link or message containing XSS payload targeting an Exchange web surface (e.g., OWA/ECP) and lures an Exchange user into opening it. When the victim's browser renders the unneutralized input, the script executes in the Exchange web origin, enabling spoofing of trusted content and potential theft or manipulation of session-bound data. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim interacting with attacker-supplied content (UI:R).