Microsoft has disclosed a critical cross-site scripting flaw in Microsoft Exchange Server, scored CVSS 9.3, that allows an unauthorized attacker to perform spoofing over a network.
What Is It
CVE-2026-69356 is an improper neutralization of input during web page generation, a cross-site scripting weakness (CWE-79), in Microsoft Exchange Server. Per Microsoft's advisory, the flaw allows an unauthorized attacker to perform spoofing over a network.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, yielding a base score of 9.3 (CRITICAL). The combination is what pushes this into critical territory: the attack is reachable over the network with low complexity and no privileges required, and the scope is changed, meaning impact extends beyond the vulnerable component itself. Confidentiality and integrity impacts are both HIGH; availability is not affected. User interaction is required, so exploitation depends on a target interacting with attacker-supplied content.
Why It Matters
Exchange Server sits at the center of enterprise mail and identity workflows, and its web surfaces are routinely exposed. A pre-authentication, network-reachable XSS with changed scope and high confidentiality/integrity impact is a strong foothold for credential and session abuse against a high-value system.
The CVE is currently in "Awaiting Analysis" status at NVD, and the CVSS data comes from Microsoft as the primary source. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the material available here, and no KEV-mandated remediation deadline.
What's Vulnerable
All affected products are x64-based systems:
| Product | Affected versions |
|---|---|
| Exchange Server 2016 Cumulative Update 23 | 15.01.0.0 → before 15.01.2507.073 |
| Exchange Server 2019 Cumulative Update 14 | 15.02.0.0 → before 15.02.1544.046 |
| Exchange Server 2019 Cumulative Update 15 | 15.02.0.0 → before 15.02.1748.051 |
| Exchange Server Subscription Edition RTM | 15.02.0.0 → before 15.02.2562.049 |
Patch Status
Fixed builds are identified in the version data above; updating each affected Exchange deployment to at least the listed build number remediates the issue. Consult the Microsoft Security Response Center update guide entry for the applicable update package. No explicit CISA-required action or due date accompanies this CVE in the supplied material.
Sources
- Microsoft Security Response Center; CVE-2026-69356: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69356
- NVD, CVE-2026-69356: https://nvd.nist.gov/vuln/detail/CVE-2026-69356