CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability

Analysis on rafaelpfister.ch

Article · October 14, 2026 October 2026 Exchange security updates: six vulnerabilities, final update for Exchange 2016 and 2019 The October SU closes six vulnerabilities, including a critical remote code execution issue through a crafted email, and fixes the .ics issue and the WordBreaker deadlock. It is the final update for Exchange 2016 and 2019, including under the ESU program.

Vendor description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

9.3 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Weakness type

CWE-79: Cross-Site Scripting

Published

October 13, 2026

Official sources

← All vulnerabilities

CVE-2026-70279 Microsoft Exchange Server Spoofing Vulnerability

Analysis on rafaelpfister.ch

Vendor description

Reference data

Official sources

Subscribe