The vulnerability is a cross‑site scripting (XSS) flaw caused by improper neutralization of user‑supplied input during web page generation in Microsoft Exchange Server. An unauthorized attacker can inject malicious scripts that the server will render, allowing the attacker to spoof the identity of legitimate users or processes over a network.

Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, and Microsoft Exchange Server Subscription Edition RTM are affected.

The CVSS score of 8.1 indicates high severity, and the EPSS score of 6% reflects a low probability of exploitation in the wild. However, the vulnerability is listed in CISA’s KEV catalog, confirming real‑world exploitation. Based on the description, the likely attack vector is via unsanitized user input delivered over the network from an unauthorized source. During exploitation the attacker can inject scripts that the server will execute, enabling identity spoofing without privileged access.