This vulnerability (CVE-2026-45500) affects Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). It is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to cross-site scripting (XSS). Exploitation could allow an unauthorized attacker to conduct spoofing attacks over a network. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability. Microsoft has released an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to perform spoofing attacks by injecting malicious scripts into web pages generated by the affected Exchange Server. This can lead to partial compromise of confidentiality and integrity of data accessible through the web interface. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500 to remediate this vulnerability. Since the vendor has issued an official fix, applying this patch is the recommended mitigation.