The vulnerability is a cross‑site scripting (XSS) flaw caused by improper neutralization of user‑supplied input during web page generation in Microsoft Exchange Server. An unauthenticated attacker can inject malicious scripts that the server will render, allowing the attacker to spoof the identity of legitimate users or processes over a network, potentially enabling further attacks.

Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, and Microsoft Exchange Server Subscription Edition RTM are affected.

The CVSS score of 8.1 indicates high severity, and the EPSS score of 12% reflects a moderate probability of exploitation in the wild. However, the vulnerability is listed in CISA’s KEV catalog, confirming real‑world exploitation. Based on the description, the likely attack vector is via unsanitized user input delivered over the network from an unauthorized source. During exploitation the attacker can inject scripts that the server will execute, enabling identity spoofing or other malicious actions without authenticated privileges. The presence in KEV and the high CVSS emphasize the need for prompt mitigation.