This vulnerability (CVE-2026-21527) in Microsoft Exchange Server 2016 CU23 is classified under CWE-451, indicating a user interface misrepresentation of critical information. It enables an attacker without privileges to spoof information over the network, potentially misleading users or systems relying on the UI. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

The vulnerability allows unauthorized attackers to spoof critical information in the Exchange Server UI, which could lead to users or systems being misled about the authenticity or state of information presented. This impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft for this vulnerability. It is recommended to apply the security update provided in Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527 to remediate the issue. No additional mitigations are specified or required beyond applying the official patch.