CVE-2026-70279
9.3CriticalPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-79
Impact
Attackers can run malicious scripts in a user's browser session and hijack accounts or access sensitive email data. Exploitation requires network access and tricking an authenticated user into clicking a crafted link.
Root cause
Improper input neutralization during web page generation allows reflected or stored cross-site scripting in Microsoft Exchange Server web interfaces.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Fix & remediation
Install the security update from Microsoft via the advisory link (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279). If patching must wait, place Exchange behind a reverse proxy or WAF with rules blocking cross-site scripting payloads.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.