CVE-2026-70279
Microsoft Exchange Server Spoofing Vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 15.01.2507.077, 15.02.1544.050, 15.02.1748.055, 15.02.2562.056
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Affected versions
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
From 15.01.0.0 · fixed in 15.01.2507.077
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
From 15.02.0.0 · fixed in 15.02.1544.050
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
From 15.02.0.0 · fixed in 15.02.1748.055
- Microsoft Microsoft Exchange Server Subscription Edition RTM
From 15.02.0.0 · fixed in 15.02.2562.056