CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Other sources
Microsoft Exchange Server Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.055Patch KB5128896 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely reachable over a network and does not require attacker privileges. Exploitation requires user interaction.
Which Exchange deployments are identified as affected?
The affected products listed are Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM.
What is the likely security impact if exploitation succeeds?
The vulnerability is classified as cross-site scripting and spoofing. The supplied severity vector indicates high confidentiality and integrity impact, no availability impact, and scope change.