CVE-2026-55008
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
Risk Assessment
An attacker could exploit this vulnerability to impersonate trusted sources, potentially leading to credential theft or malware distribution within the organization.
Recommendation
Apply the security update provided by Microsoft for Microsoft Exchange Server immediately. Additionally, implement input validation and Content Security Policy (CSP) mechanisms.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.