MSRC-CVE-2026-55008 — Microsoft Exchange Server Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit this issue by sending a specifically crafted malicious email to the user. If the user opens this email, in Outlook Web Access, and certain conditions are met, arbitrary execution of JavaScript would occur in the browser context.

Security updates
15.01.2507.071 — https://support.microsoft.com/help/5103215
15.02.1544.043 — https://support.microsoft.com/help/5103214
15.02.1748.048 — https://support.microsoft.com/help/5103213
15.02.2562.045 — https://support.microsoft.com/help/5103212

Vulnerabilities 1

Critical 9.6

CVE-2026-55008

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jul 14, 2026

Revision history

2026-07-14 #1
Information published.

References

CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss