What is the CVSS score of EUVD-2026-56416?

EUVD-2026-56416 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Exchange Server are affected by EUVD-2026-56416?

Microsoft Exchange Server 2016 and 2019 contain a cross-site scripting vulnerability (CVSS 7.3) requiring authenticated user access that could enable spoofing of higher-privileged accounts and…. A patch is available.

How to fix or mitigate EUVD-2026-56416?

Within 24 hours, inventory your Exchange Server deployment to identify systems running Exchange 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM. Within 7 days, apply the Microsoft security patch to all affected Exchange systems after validating compatibility in a test environment; prioritize systems with the largest user base. Within 30 days, complete patch rollout across all production Exchange infrastructure and review email access logs from the prior 30 days for any signs of XSS injection attempts or suspicious account activity.

Exchange Server EUVD-2026-56416

| CVE-2026-62914 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 secure@microsoft.com

GHSA-r293-pwww-9gh8

XSS Microsoft Exchange Server Exchange Server Subscription Edition

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

7.3 HIGH

Network-delivered XSS requires an authenticated low-privilege account and active victim interaction; C:H and I:H reflect session token theft and spoofing capability; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 13, 2026 - 19:07 NVD

HIGH MEDIUM

CVSS changed

Aug 13, 2026 - 19:07 NVD

7.3 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Aug 11, 2026 - 18:55 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.3

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Special Elements Used in a Web Page - Cross-Site Scripting), where user-supplied input is reflected or persisted in HTTP responses without adequate encoding or sanitization before being rendered in another user's browser context. Exchange Server's web-facing components - including Outlook Web App (OWA) and Exchange Admin Center (EAC) - accept and process authenticated user input that can subsequently be rendered for other users' sessions. Affected version ranges confirmed by ENISA EUVD-2026-56416 cover Exchange 2016 CU23 (15.01.x prior to 15.01.2507.072), Exchange 2019 CU14 (15.02.x prior to 15.02.1544.044), Exchange 2019 CU15 (15.02.x prior to 15.02.1748.049), and Exchange Server Subscription Edition RTM (15.02.x prior to 15.02.2562.046). The spoofing impact described is consistent with XSS enabling session token theft, UI redress, or identity impersonation within Exchange web sessions.

RemediationAI

Organizations should apply the vendor-released patch by upgrading to the following fixed builds as published in MSRC and ENISA EUVD-2026-56416: Exchange 2016 CU23 to version 15.01.2507.072 or later, Exchange 2019 CU14 to version 15.02.1544.044 or later, Exchange 2019 CU15 to version 15.02.1748.049 or later, and Exchange Server Subscription Edition to version 15.02.2562.046 or later. Full patching guidance is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62914. Where immediate patching is not feasible, restricting access to OWA and EAC endpoints to trusted internal networks or VPN-only connections reduces the network-accessible attack surface, though it does not eliminate risk from internal low-privilege accounts. Deploying a strict Content Security Policy header on Exchange front-end servers may reduce XSS exploitability as a compensating control, but this is not a substitute for the vendor patch and may introduce compatibility issues with Exchange web client functionality.