CVE-2026-47631
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server due to improper input neutralization during web page generation. Allows an unauthorized attacker to perform spoofing over a network.
Risk Assessment
An attacker can impersonate another user or site, potentially leading to credential theft or other fraud.
Recommendation
Install the latest security updates for Microsoft Exchange Server.
Other vulnerabilities in Microsoft Exchange Server
See all- CVE-2026-87696High
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-87695High
A vulnerability in Microsoft Exchange Server involves inclusion of functionality from an untrusted control sphere. An authorized attacker can elevate privileges locally.
- CVE-2026-87692High
A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-77910High
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70571High
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-70279Critical
Improper neutralization of input during web page generation (cross-site scripting) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-69641Critical
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69356Critical
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55008Critical
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
- CVE-2026-45502Medium
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS