AI analysis
CVE-2026-70279 is a cross-site scripting flaw (CWE-79) in Microsoft Exchange Server caused by improper neutralization of input during web page generation. An unauthenticated attacker on the network can supply malicious input that is rendered in a page a victim loads, so exploitation requires user interaction. Successful use can spoof content or actions in a changed security scope, with high impact on confidentiality and integrity and no direct availability impact (CVSS 3.1 base score 9.3). On-premises Exchange Server deployments are affected; the advisory data does not name specific version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply Microsoft's security update for CVE-2026-70279 to on-premises Exchange Server as soon as it is available for your build, and confirm the fix in the Microsoft Security Update Guide. Until then, limit internet exposure of Outlook on the web and the Exchange admin center, and treat unexpected Exchange web content or links as untrusted because exploitation needs a user to load attacker-controlled content.
Affected
| Microsoft Exchange Server | — |
Estimated exposure
large≈10,000–100,000+ internet-reachable Exchange servers (order-of-magnitude estimate; total on-prem installs are larger) — Estimate from the large enterprise installed base of on-premises Exchange and public internet-scan reporting that has typically shown on the order of tens of thousands to low hundreds of thousands of reachable Exchange servers; no plugin…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.