Microsoft Exchange Server cross-site scripting allows spoofing (CVE-2026-70279)

What happened

The CVE record describes CVE-2026-70279 as improper neutralization of input during web page generation, a cross-site scripting weakness, in Microsoft Exchange Server. Microsoft states that an unauthorized attacker can use it to perform spoofing over a network.

According to the CVSS 3.1 vector, the flaw is reachable over the network, has low attack complexity and requires no privileges, but a user must interact with attacker-controlled content. The vector marks confidentiality and integrity impact as high and does not mark availability impact.

CISA has not added this vulnerability to its Known Exploited Vulnerabilities catalogue, and Microsoft has not stated that it is being exploited. Microsoft's security update guide rates the issue Important; the CVE record assigns a base score of 9.3.

Who is affected

Affected Microsoft Exchange Server builds are:

• Exchange Server 2016 Cumulative Update 23, versions 15.01.0.0 to before 15.01.2507.077
• Exchange Server 2019 Cumulative Update 14, versions 15.02.0.0 to before 15.02.1544.050
• Exchange Server 2019 Cumulative Update 15, versions 15.02.0.0 to before 15.02.1748.055
• Exchange Server Subscription Edition RTM, versions 15.02.0.0 to before 15.02.2562.056

Exchange Server is the on-premises mail and calendaring platform, commonly used with Outlook on the web and the Exchange admin centre. Organisations running these builds should treat themselves as affected until they install the matching October 2026 update.

What to do now

1. Apply the October 2026 Microsoft security update that matches your Exchange Server version:

• Exchange Server 2016 CU23: 15.01.2507.077 (KB5128898)
• Exchange Server 2019 CU14: 15.02.1544.050 (KB5128897)
• Exchange Server 2019 CU15: 15.02.1748.055 (KB5128896)
• Exchange Server Subscription Edition RTM: 15.02.2562.056 (KB5128895)

1. Microsoft's advisory does not publish a workaround, so patching is the primary remediation.
2. The CVSS vector records user interaction, so remind staff to treat unexpected messages and web links with care, especially around Exchange sign-in pages.

Beyond the patch

A network-reachable Exchange Server flaw is an exposure management problem before it is anything else. Virtual CISO Services (vCISO) can help you map the Exchange services reachable from your network and prioritise updates against that exposure, because an unauthenticated network-reachable service is exactly what exposure management catches. After patching, Managed Detection & Response (MDR) provides visibility into the identity and mail activity that a spoofing attack tries to abuse.