Microsoft Exchange Server cross-site scripting enables network spoofing (CVE-2026-70279)

What happened

Microsoft Exchange Server has an improper neutralization of input during web page generation, known as cross-site scripting (CWE-79). The flaw allows an unauthorised attacker to perform spoofing over a network. The CVSS 3.1 vector shows a network-based attack with low complexity and no privileges required, but a user must interact. Microsoft rates this Important; the CVSS 3.1 score is 9.3 critical.

The impact is limited to confidentiality and integrity; there is no availability impact. The CVE record does not list exploitation, and Microsoft has not said that the flaw is being used in attacks.

Who is affected

Affected builds are:

• Microsoft Exchange Server 2016 Cumulative Update 23: versions 15.01.0.0 to before 15.01.2507.077
• Microsoft Exchange Server 2019 Cumulative Update 14: versions 15.02.0.0 to before 15.02.1544.050
• Microsoft Exchange Server 2019 Cumulative Update 15: versions 15.02.0.0 to before 15.02.1748.055
• Microsoft Exchange Server Subscription Edition RTM: versions 15.02.0.0 to before 15.02.2562.056

These are on-premises Exchange roles that organisations typically expose to the internet for client access. You are affected if you run one of these build lines below the fixed build.

What to do now

1. Patch. Apply the October 2026 update for your build:

• Exchange 2016 CU23: 15.01.2507.077 — KB5128898
• Exchange 2019 CU14: 15.02.1544.050 — KB5128897
• Exchange 2019 CU15: 15.02.1748.055 — KB5128896
• Exchange Server Subscription Edition RTM: 15.02.2562.056 — KB5128895

1. Because the flaw is reachable over a network without credentials, review and restrict internet accessibility of Exchange web endpoints until patching is complete.

1. Microsoft has not published a workaround. After patching, monitor mail and identity events for unusual activity.

Beyond the patch

Exchange sits at a difficult intersection: internet-facing, mail-bearing, and tied to identity. A network-reachable, no-credential web flaw such as this is a reason to have exposure management in place before the next update cycle. Our Virtual CISO Services (vCISO) can help you map and reduce that exposure, and Managed Detection & Response (MDR) watches the identity and mail paths this kind of flaw feeds into. Patch first, then make sure both controls are in place.