This vulnerability (CWE-79) in Microsoft Exchange Server 2016 CU23 arises from improper neutralization of input during web page generation, enabling cross-site scripting attacks. Exploitation could allow an attacker to perform spoofing attacks over a network, potentially leading to limited confidentiality and integrity impacts. The vulnerability has been assigned CVE-2026-45500 with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Microsoft has released an official fix to address this issue.

Successful exploitation could allow an attacker to conduct cross-site scripting attacks that result in spoofing, impacting confidentiality and integrity of data in affected Microsoft Exchange Server 2016 CU23 environments. There is no indication of availability impact. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update provided in Microsoft Exchange Server 2016 Cumulative Update 23 as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500. No additional mitigation steps are specified by the vendor.