Microsoft patches Exchange Server zero-day exploited in attacks
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 2019.9999 : patch affected systems soon.
Data as of 11 Jun 2026, 15:54 UTC
Rated High by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 2019.9999, 2016.9999
What to do
AI-suggested
Microsoft has released official security updates for Exchange Server 2016, 2019, and Subscription Edition to address this vulnerability. Administrators should deploy these June 2026 security updates as soon as possible. Additionally, Microsoft recommends maintaining the previously deployed Exchange Emergency Mitigation Service (EEMS) temporary mitigation to provide an additional layer of defense. No further action beyond applying the patch and retaining the mitigation is indicated by the vendor.
Description
Microsoft has patched an actively exploited Exchange Server vulnerability that allows threat actors to execute arbitrary JavaScript code in cross-site scripting (XSS) attacks targeting Outlook Web Access users. [...]