This vulnerability (CVE-2026-47631) affects Microsoft Exchange Server 2016 Cumulative Update 23 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It allows an attacker to exploit cross-site scripting flaws to conduct spoofing attacks remotely without privileges and requires user interaction. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with high impact on confidentiality and integrity but no impact on availability. Microsoft has released an official fix for this issue as documented in their security update guide.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to spoofing attacks that compromise confidentiality and integrity of data. There is no impact on system availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for this vulnerability. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631. Applying this update will remediate the vulnerability.