CVE-2026-70279: Microsoft Exchange Server 2016 Cumulative Update 23

Critical severity, CVSS 9.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Affected products

• Microsoft Microsoft Exchange Server 2016 Cumulative Update 23: from 15.01.0.0, before 15.01.2507.077 (fixed in 15.01.2507.077)
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 14: from 15.02.0.0, before 15.02.1544.050 (fixed in 15.02.1544.050)
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 15: from 15.02.0.0, before 15.02.1748.055 (fixed in 15.02.1748.055)
• Microsoft Microsoft Exchange Server Subscription Edition Rtm: from 15.02.0.0, before 15.02.2562.056 (fixed in 15.02.2562.056)

Published 2026-10-13. Last modified 2026-10-13.