CVE-2026-45501

Published: Jun 9, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Affected (4)

Products: Microsoft: Exchange Server, Exchange Server Subscription Edition

Microsoft

2 products

Exchange Server

Exchange Server Subscription Edition

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2016 cumulative_update_23
Microsoft Exchange Server	Version 2019 cumulative_update_14
Microsoft Exchange Server	Version 2019 cumulative_update_15
Microsoft Exchange Server Subscription Edition	Before 15.02.2562.043

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.