CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server
This text was generated using artificial intelligence (AI).On October 13, 2026, Microsoft released the vulnerability CVE-2026-70279 for Microsoft Exchange Server. The vulnerability is rated with a CVSS base score of 9,3 (Temporal: 8,1) rated. Microsoft classifies it as Important and assesses exploitation as „Exploitation More Likely“.
CVE-2026-70279 affects the processing of inputs when generating web pages. The underlying vulnerability class is CWE-79: Cross-Site Scripting. The attack is network-based and requires user interaction. According to Microsoft MSRC, attackers can trick a victim into clicking a crafted link through social engineering.
Microsoft provides security updates for the following Exchange variants:
Exchange Server Subscription Edition RTM: KB5128895
Exchange Server 2019 CU15: KB5128896
Exchange Server 2019 CU14: KB5128897
Exchange Server 2016 CU23: KB5128898
The patch status of the deployed Exchange systems should be checked and the respective assigned security update should be installed. Microsoft recommends timely application of the updates.
Exchange Server 2016 and Exchange Server 2019 are out of regular support (End-of-Support: October 14, 2025). Security updates for these variants are available through the Period-2-ESU program. As a long-term option, Microsoft recommends migrating to Exchange Server Subscription Edition.
Risk from XSS spoofing in Exchange web interfaces
The vulnerability can be triggered by accessing a crafted link in an Exchange web interface. The documented impacts include spoofing and — if successfully exploited against a victim with administrative rights — access to or alteration of organizational data.
Particular attention should be paid to systems with externally accessible Exchange web interfaces and administrative accounts that utilize these services. Three questions are relevant for operational handling:
Which Exchange systems are externally accessible?
What product version is in use on the respective systems?
Which of the four provided updates is associated with the system?
The answers support the assignment to responsible teams and the scheduling of updates in change and maintenance processes.
For organizations in Germany and Austria that fall under the NIS-2 directive (implemented in Germany via the BSIG, in Austria via the NISG), externally accessible Exchange instances are part of the reportable attack surface. In the event of a successful attack resulting in access to personal data, the GDPR reporting obligation under Art. 33 (72-hour deadline to the relevant supervisory authority) also applies. For organizations in Switzerland, the revised Information Security Act (ISG) with reporting obligation to the BACS applies.
Visibility for Externally Accessible Exchange Services
LocateRisk supports the identification of publicly accessible systems and deployed software under its own domains. This allows externally accessible Exchange instances to become visible in the asset inventory, such as with multiple domains, subsidiaries, or decentralized mail servers.
This visibility supports the prioritization of checking whether Exchange services exist and which teams are responsible for them. The specific assignment of a security update still requires checking the patch status on the respective system.
Additionally, Continuous Vendor Risk Management can provide insights when critical vulnerabilities are published by technology providers or when their security level changes. For CVE-2026-70279, the immediate focus is on the publicly accessible Exchange services and their update status.
LocateRisk is Made in Germany, is operated exclusively in German data centers, and does not process data through U.S. providers.
Am I affected?
This affects Microsoft Exchange Server; the vulnerability was fixed in [object Object], [object Object], [object Object], [object Object]. Those who want to know if Microsoft Exchange Server is even visible in their externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-70279 is a spoofing vulnerability in Microsoft Exchange Server that is based on a cross-site scripting weakness (CWE-79). It was published by Microsoft on October 13, 2026, and rated with a CVSS base score of 9.3.
This affects Exchange Server SE RTM, Exchange Server 2019 CU15 and CU14 as well as Exchange Server 2016 CU23. Microsoft provides the security updates KB5128895, KB5128896, KB5128897, and KB5128898. For Exchange Server 2016 and 2019, the patches are available exclusively through the paid Period-2-ESU program.
Exchange Server 2016 and 2019 will reach their regular end of support on October 14, 2025. The Period-2-ESU program extends the availability of security-related updates until October 2026 for separate licensing fees. It does not replace full vendor support and covers only security patches.
As of: October 14, 2026. This article is for general informational purposes and does not constitute legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we make no warranty for timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-70279
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français