This vulnerability (CVE-2026-45500) affects Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). It is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to cross-site scripting (XSS). Exploitation could allow an attacker to perform spoofing attacks over a network. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity with scope change. Microsoft has released an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an unauthorized attacker to conduct spoofing attacks by injecting malicious scripts into web pages generated by the affected Microsoft Exchange Server. This may lead to partial compromise of confidentiality and integrity of data accessible through the web interface. There is no impact on availability reported. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft for this vulnerability. Administrators should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500. Applying this patch will remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.