MSRC-CVE-2026-47631 — Microsoft Exchange Server Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could attempt to exploit this vulnerability by convincing an Exchange administrator to open specially crafted content, such as a malicious link or message, which could allow the attacker to run code in the administrator’s web session.

Security updates
15.01.2507.071 — https://support.microsoft.com/help/5103215
15.02.1544.043 — https://support.microsoft.com/help/5103214
15.02.1748.048 — https://support.microsoft.com/help/5103213
15.02.2562.045 — https://support.microsoft.com/help/5103212

Vulnerabilities 1

High 8.1

CVE-2026-47631

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026

Revision history

2026-06-09 #1
Information published.

References

CVE-2026-47631 Microsoft Exchange Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss