Advisory · CVE-2026-70279
Cross-site scripting in Microsoft Exchange Server can act on a victim session
Microsoft Exchange Server has an input neutralization flaw during web page generation: script an attacker plants can run in a victim's browser with changed scope. Microsoft rates it CVSS 3.1 9.3.
- Vendor
- Microsoft
- Product
- Microsoft Exchange Server
- Identifier / CWE
- CVE-2026-70279
CWE-79 - Action timing
- Immediate
Explain it like I’m five
The mail server's web interface can be made to serve an attacker's script as if it were its own, and whoever clicks gets to run it with their mailbox session.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Microsoft Exchange Server.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-70279 in its October 2026 update guide: improper neutralization of input during web page generation (CWE-79) in Microsoft Exchange Server, including the Subscription Edition, letting script execute in the context of a user who interacts with it.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft Exchange Server deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft Exchange Server while remediation is underway, especially for internet-facing instances.
- Review application and server logs for suspicious links or messages reported by mailbox users, unexpected mailbox rules, and admin sessions from new locations.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Exchange web interfaces are high-value phishing ground. Apply the Exchange update on its own urgent track and remind admins to treat odd OWA behavior as a signal.