Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-70279: Microsoft Exchange Server lets attackers spoof messages

CVE-2026-70279 · published 22 days ago

Summary

Versions of Microsoft Exchange Server 2016 (CU23) and 2019 (CU14, CU15) and the Subscription Edition can be tricked into displaying forged information. This could allow an unauthenticated person to make email appear to come from someone else, potentially confusing users or facilitating phishing. Apply the latest security updates from Microsoft as soon as possible to close the gap.

What to do

Update microsoft microsoft exchange server 2016 cumulative update 23 to version 15.01.2507.077 or later.
Update microsoft microsoft exchange server 2019 cumulative update 14 to version 15.02.1544.050 or later.
Update microsoft microsoft exchange server 2019 cumulative update 15 to version 15.02.1748.055 or later.
Update microsoft microsoft exchange server subscription edition rtm to version 15.02.2562.056 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft exchange server 2016 cumulative update 23	< 15.01.2507.077
microsoft	microsoft exchange server 2019 cumulative update 14	< 15.02.1544.050
microsoft	microsoft exchange server 2019 cumulative update 15	< 15.02.1748.055
microsoft	microsoft exchange server subscription edition rtm	< 15.02.2562.056

Original advisory text

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.3 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published13 Oct 2026

Updated31 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-70279 · NVD

CVE-2026-70279 · MITRE

Track software like this

Free during beta