CVE-2026-62914
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
- EPSS probability
- 0.34%
- CWE
- CWE-79
- Published
- 2026-08-11
- Last modified
- 2026-09-16
Affected products
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
- Microsoft Microsoft Exchange Server Subscription Edition RTM
Weakness type
Related vulnerabilities
- CVE-2026-78252 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-88866 — WWBN AVideo LoginControl Stored XSS via User-Agent Header
- CVE-2026-90943 — parallax filament-comments through 3.0.0 Stored XSS via Comment Body
- CVE-2026-90561 — Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
- CVE-2026-89256 — AVideo Bookmark Plugin Stored XSS via Chapter Names
- CVE-2026-89255 — AVideo LoginControl Stored XSS via PGP Public Key
- CVE-2026-89254 — AVideo CustomizeUser Stored XSS via field_name Parameter