This vulnerability (CWE-79) in Microsoft Exchange Server 2016 CU23 arises from improper input neutralization during web page generation, enabling cross-site scripting attacks. Exploitation could allow an attacker to conduct spoofing attacks remotely without privileges, requiring user interaction. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, reflecting its network attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality and integrity. Microsoft has issued an official fix to remediate this issue.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to spoofing attacks that compromise confidentiality and integrity of user data. Availability is not impacted. The vulnerability can be exploited remotely over the network without authentication but requires user interaction.

An official fix is available from Microsoft. Users should apply the security update provided in Microsoft Exchange Server 2016 Cumulative Update 23 as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 to remediate this vulnerability.