EUVD-2026-44026
GHSA-xpfg-cjj6-56wx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network XSS needing victim rendering (UI:R) with no auth (PR:N); scope change (S:C) into the user session; high confidentiality from session/data theft, limited integrity via spoofing, no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Stored/reflected cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a network-based, unauthenticated attacker inject malicious script that executes in a victim's browser session, enabling spoofing and - per the scope-changed CVSS 9.6 vector - high impact to confidentiality, integrity, and availability of resources beyond the vulnerable component. Exploitation requires the target to view attacker-controlled content (UI:R). Microsoft has released a patch; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The flaw is a CWE-79 improper neutralization of input during web-page generation in Microsoft Exchange Server's web-facing surface (typically Outlook Web App / Exchange Control Panel components that render user-supplied content such as message bodies, headers, or form fields). Because Exchange embeds unsanitized input into generated HTML, attacker-controlled markup is parsed and executed by the victim's browser in the security context of the Exchange web origin. The affected CPEs are microsoft:microsoft_exchange_server_2016_cumulative_update_23, 2019_cumulative_update_14, 2019_cumulative_update_15, and subscription_edition_rtm, indicating on-premises Exchange builds are in scope. The CVSS scope change (S:C) reflects that script running in the OWA origin can pivot against the authenticated user's mailbox session and other resources beyond the injected page itself.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for your Exchange build (2016 CU23, 2019 CU14, 2019 CU15, or Subscription Edition RTM) as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008 - the exact fixed build numbers are listed in that MSRC entry and should be applied to every affected server and cumulative update level. Exchange updates must be installed with administrative privileges and often require a services restart, so schedule a maintenance window and update all servers in a DAG to the same patch level to avoid coexistence issues. As a compensating control until patched, restrict internet exposure of Outlook Web App / ECP by placing them behind a VPN or trusted-network access policy and, where feasible, enable strict content-filtering at the mail gateway to strip active HTML/script from inbound messages - noting this can break legitimately formatted mail. Because exploitation requires user interaction, user-awareness guidance to avoid opening suspicious OWA content is a partial mitigation but not a substitute for the update.
Cross-site scripting (XSS) in Microsoft Exchange Server enables remote attackers to spoof content and steal credentials
Remote code execution in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an aut
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today