Cross-site scripting in Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition RTM - CVE-2026-70279
Published: October 14, 2026
Vulnerability identifier: #VU154951
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-70279
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary scripts in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Exchange Server when generating web content. A remote attacker can send a specially crafted link and persuade a user to open it to execute arbitrary scripts in the victim's browser.
If the victim has administrative privileges, exploitation could allow actions using those privileges, potentially enabling access to or modification of organizational data.
Affected software
Microsoft Exchange Server
Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server Subscription Edition RTM
How to mitigate CVE-2026-70279
Install security update from vendor's website.
Microsoft Exchange Server - addressed in versions 15.01.2507.077, 15.02.1544.050, 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056