Microsoft Exchange Server: Cross-site scripting allows spoofing
Summary
Microsoft Exchange Server on-premises contains a cross-site scripting (XSS) flaw (CWE-79) that allows spoofing of Exchange web pages. An unauthenticated remote attacker can exploit it, but a victim must act, for example by clicking a crafted link, and the CVSS score is 9.3 (critical) with changed scope and high confidentiality and integrity impact. Microsoft's description states that the impact is spoofing rather than code execution. NVD analysis was still pending at publication.
Affected
- Exchange Server 2016 CU23: 15.01.0.0 to before 15.01.2507.077
- Exchange Server 2019 CU14: 15.02.0.0 to before 15.02.1544.050
- Exchange Server 2019 CU15: 15.02.0.0 to before 15.02.1748.055
- Exchange Server Subscription Edition RTM: 15.02.0.0 to before 15.02.2562.056
- Version ranges taken from the CVE record and a third-party aggregator; confirm against MSRC.
Fixed in
- October 2026 security updates for the affected builds (according to secondary sources, not yet verified against MSRC):
- Subscription Edition RTM: KB5128895
- Exchange Server 2019 CU15: KB5128896
- Exchange Server 2019 CU14: KB5128897
- Exchange Server 2016 CU23: KB5128898 (last update for 2016 and 2019 under ESU Period 2)
Workaround
Unknown. No vendor-published workaround was found; patching is the only documented remediation.
Exploitation
- No known exploitation in the wild at publication; CISA SSVC lists exploitation as none and automatable as no.
- No public proof-of-concept known.
- One article reports 'Exploitation More Likely', which is a Microsoft prediction, not observed exploitation.
Our recommendation
- Check whether Exchange is reachable from the internet (e.g. OWA) and prioritise patching accordingly.
- Confirm the Exchange build against the KB table above and apply the October 2026 security update for your version.
- Review the Windows Server October 2026 update warning before patching, as those updates may destabilise on-premises Exchange.
- Exchange 2016 and 2019 receive no further fixes after October 2026; plan migration to Subscription Edition.
- Patch the other Exchange CVEs from the same release together with this one.
- Monitor for signs of exploitation and check MSRC for mitigation updates.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Spoofing – Microsoft Exchange Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …)
- Updates (KB)
- KB5128896, KB5128897, KB5128898, KB5128895
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-70279 msrc.microsoft.com
- Microsoft Exchange Team: October 2026 Exchange Server security updates techcommunity.microsoft.com
- OpenCVE: CVE-2026-70279 app.opencve.io
- Tenable plugin 365663 www.tenable.com
- Senserva KB 5128895 senserva.com
- Feedly: CVE-2026-70279 feedly.com
- Windows Forum: Exchange October 2026 updates windowsforum.com
- TechCertGuide: Windows Server updates and Exchange techcertguide.blog
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:16.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.