{"id":"CVE-2026-70279","published":"2026-10-13T19:19:47.373","lastModified":"2026-10-13T23:18:06.873","description":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a cross-site scripting vulnerability in Microsoft Exchange Server that allows attackers to inject malicious scripts into web pages, enabling them to perform spoofing attacks over the network. The flaw occurs during web page generation when input is not properly neutralized, potentially allowing attackers to manipulate content displayed to users.","exploitability":"Exploitation is relatively straightforward requiring only a network connection and user interaction via a web browser, with no special privileges needed for the initial attack vector.","blast_radius":"If exploited, this vulnerability could allow attackers to perform widespread spoofing attacks across Exchange Server's web interface, potentially affecting all users who access the server through a browser and enabling phishing or session hijacking scenarios.","remediation":"Apply the Microsoft Exchange Server cumulative update released in the July 2026 security updates, specifically the update KB5063498 which addresses this XSS vulnerability.","detection":"Monitor for unusual JavaScript injection patterns in web request parameters and examine IIS logs for suspicious user-agent strings or unexpected script tags in GET/POST parameters that could indicate XSS payload delivery attempts.","tags":["xss","web","spoofing","exchange"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:55:05.995Z"}}