Microsoft Exchange Server is vulnerable to an improper neutralization of input during web page generation, known as cross‑site scripting. This flaw allows an unauthorized attacker to inject malicious content that the server renders, leading to spoofing of messages or identities over the network.

The vulnerability affects Microsoft Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14, Exchange Server 2019 Cumulative Update 15, and Exchange Server Subscription Edition RTM. All listed versions remain vulnerable until the corresponding cumulative update or patch for CVE‑2026‑45501 is applied.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1% (approximately 0.00297), and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is expected to be network‑based, with an attacker sending HTTP or HTTPS requests containing malicious payloads that trigger the cross‑site scripting flaw. Upon exploitation, the server can produce content that deceives users or devices into accepting spoofed identities or communications. Because the flaw does not require the attacker to have pre‑existing credentials, the risk is higher for systems that expose web services to untrusted networks, but patching remains the most effective mitigation.