This vulnerability (CWE-79) in Microsoft Exchange Server 2016 CU23 arises from improper neutralization of input during web page generation, enabling an authorized attacker to conduct cross-site scripting attacks that can lead to spoofing. The CVSS 3.1 base score is 7.3, indicating high severity, with network attack vector, low complexity, and requiring privileges and user interaction. Microsoft has issued an official fix for this vulnerability as detailed in their security update guide.

Successful exploitation allows an authorized attacker to perform spoofing attacks over a network, potentially leading to compromise of confidentiality and integrity of data. Availability is not impacted. The vulnerability requires the attacker to have some privileges and user interaction, limiting the attack scope.

An official fix is available from Microsoft. Administrators should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62914. No additional mitigation steps are indicated by the vendor advisory.