Improper neutralization of input during web page generation in Microsoft Exchange Server creates a cross‑site scripting flaw that an attacker can exploit to impersonate legitimate traffic or users across the network, effectively allowing the attacker to spoof requests and responses without authentication.

The flaw impacts Microsoft Exchange Server 2016 with Cumulative Update 23, Microsoft Exchange Server 2019 with Cumulative Updates 14 and 15, and the Microsoft Exchange Server Subscription Edition in its RTM state.

The vulnerability carries a CVSS score of 9.3, classifying it as critical. The EPSS score is not available and it is not yet listed in CISA’s KEV catalog. Because the description indicates an unauthorized attacker can perform spoofing without needing elevated privileges, the likely attack vector is remote exploitation through crafted web input, requiring only network access to the vulnerable Exchange endpoints.