Microsoft Exchange Server Spoofing Vulnerability

How could an attacker exploit this vulnerability?
An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default. If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service. You can find more information and instruction in the Exchange blog here.
No, because Content Security Policy (CSP) is not supported by Internet Explorer nor Microsoft Edge using Internet Explorer Mode. To stay protected, please make sure to not use Internet Explorer (Mode) to access OWA.
Microsoft recommends installing the July 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability and related CVE-2026-55008 vulnerability. Mitigations that have been applied either using the Exchange Emergency Mitigation Service or the EOMT script can be removed after July 2026 update is installed. Please see the Exchange blog post for more information.

Security updates
15.01.2507.069 — https://support.microsoft.com/help/5094144
15.02.1544.041 — https://support.microsoft.com/help/5094142
15.02.1748.046 — https://support.microsoft.com/help/5094140
15.02.2562.043 — https://support.microsoft.com/help/5094139