This vulnerability (CVE-2026-55008) in Microsoft Exchange Server 2016 Cumulative Update 23 is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). The flaw allows an attacker with no privileges and requiring user interaction to execute spoofing attacks over the network, potentially compromising confidentiality, integrity, and availability of the affected system. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to perform spoofing attacks, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Exchange Server. The CVSS score of 9.6 reflects critical severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and scope change. There are no known exploits in the wild at this time.

An official fix is available from Microsoft for this vulnerability. Administrators should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008) to remediate this issue.