CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

Published Sep 8, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Affected Software

1 affected component

Microsoft Exchange Server

Event History

Sep 8, 2026

CVE Published

via MITRE·05:12 PM

Data Sourced

via MITRE·05:12 PM

DescriptionSeverity

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is reachable over a network and does not require prior privileges. Exploitation requires user interaction.

What could exploitation allow?

An attacker could perform spoofing through a cross-site scripting flaw in Microsoft Exchange Server. The supplied severity vector indicates potential high confidentiality and integrity impact, with no availability impact indicated.

Is a default Exchange Server configuration affected?

The provided information does not state which Exchange Server versions, configurations, or deployment modes are affected.

CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could exploitation allow?

Is a default Exchange Server configuration affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could exploitation allow?

Is a default Exchange Server configuration affected?