CVE-2026-55008

—

CVSS 3.1

9.6 critical

EPSS

<1%p56

Published

Jul 14, 2026 (Jul 14, 2026)

Modified

Jul 24, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Vendors: microsoft
Products: exchange server, exchange server subscription edition
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news3 stories

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Cisco TalosJul 15, 14:52 UTC · Jul 15, 2026Vulnerability in the wildCVE-2026-56155 CVE-2026-56164 CVE-2026-50370+89 CVEs

Microsoft Patches Record 622 Flaws, Including Two Zero

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Vulnerability in the wildCVE-2026-56164 CVE-2026-56155 CVE-2026-50661+6 CVEs

Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month

Security AffairsJul 14, 21:33 UTC · Jul 14, 2026Vulnerability in the wildCVE-2026-56155 CVE-2026-56164 CVE-2026-57092+5 CVEs