This vulnerability (CVE-2026-47631) is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). It affects Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). An attacker could exploit this flaw to perform spoofing attacks by injecting malicious scripts into web pages generated by the server. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality and integrity, with no impact on availability. Microsoft has published an official fix to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to spoofing attacks. This can compromise the confidentiality and integrity of data accessible through the affected Microsoft Exchange Server instance. There is no indication of availability impact or known active exploitation in the wild at this time.

An official fix is available from Microsoft to remediate this vulnerability. Organizations using Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0) should apply the provided security update as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631 for detailed patching instructions and further guidance.