Improper neutralization of user‑supplied input during web page generation in Microsoft Exchange Server leads to a cross‑site scripting flaw (CWE‑79). The vulnerability permits an attacker to inject malicious scripts that can emulate legitimate traffic or user identities, enabling deceptive actions such as phishing. The description explicitly states that an unauthorized attacker can perform spoofing over a network. While the exact consequences beyond spoofing are not detailed, it is inferred that these scripts could facilitate phishing or other deceptive actions, thereby undermining trust.

Microsoft Exchange Server 2016 is vulnerable in Cumulative Update 23, while Microsoft Exchange Server 2019 is affected in Cumulative Updates 14 and 15. The Subscription Edition at RTM release also remains impacted. All affected products are listed with their specific cumulative updates in the vendor data.

The CVSS score of 8.1 denotes high severity. No EPSS score is provided, and the vulnerability is not included in CISA’s KEV catalog, implying no publicly confirmed exploitation yet. The description indicates that an unauthorized attacker can exploit the flaw without authentication, suggesting that crafted requests can be sent over the network to trigger the XSS payload. Given the high severity, the lack of authentication requirement, and the potential to spoof traffic, the risk to network integrity and user trust remains significant.