Microsoft Exchange Server EUVD-2026-44026

Exploitation requires the victim to render attacker-controlled content in the Exchange web interface (UI:R in the CVSS vector) - for example opening a crafted message or navigating to a malicious OWA/ECP page - so it is not zero-click. The attacker needs no prior authentication or privileges (PR:N) and can deliver the payload over the network (AV:N), but the target must be a user of an unpatched on-premises Exchange Server 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM whose browser processes the injected script in the Exchange origin. The requirement for user interaction and a browser session on the vulnerable web surface is the primary factor limiting realistic exploitation.

The CVSS 3.1 base score is 9.6 (Critical) driven by AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:R (user interaction required), and S:C with C:H/I:H/A:H. The UI:R requirement is the primary limiting factor: a victim must open or render the malicious content, so this is not a wormable, zero-interaction bug despite the critical score. There is tension between the input's stated impact ('perform spoofing') and the CVSS impact metrics (C:H/I:H/A:H) - the raw vector rates impact far higher than a pure spoofing characterization would suggest, so treat the impact scope as broad session compromise rather than cosmetic spoofing, and verify specifics against the MSRC advisory. No EPSS score, SSVC decision, or KEV listing was provided; no public exploit is identified at time of analysis. Given Exchange's history as a high-value, frequently targeted attack surface, this warrants priority patching even absent confirmed exploitation, but it is a user-interaction-gated XSS rather than a pre-auth RCE.

An attacker crafts an email or web request containing malicious HTML/JavaScript that Exchange fails to neutralize when generating an OWA page; when a mailbox user opens the message or view in their browser, the script executes in the Exchange web origin, allowing session token theft, spoofed content, or actions performed as the victim. Because AC is low and no authentication is needed to deliver the payload, the main barrier is convincing the victim to render the content (UI:R). No public exploit is identified at time of analysis.