Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft issued an out of band security advisory, noting this flaw has been exploited. Mitigations are available until patches are released.

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the June, 2026 security bulletin.

  - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange     Server allows an unauthorized attacker to perform spoofing over a network. (CVE-2026-45500,     CVE-2026-45501, CVE-2026-47631)

  - Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose     information over a network. (CVE-2026-48579)

  - Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an     unauthorized attacker to execute code over a network. (CVE-2026-45583)

  - Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose     information over a network. (CVE-2026-45502, CVE-2026-45503)

  - Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-45504)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by a vulnerability as referenced in the May, 2026 security bulletin.

  - Improper neutralization of input during web page     generation ('cross-site scripting') in Microsoft     Exchange Server allows an unauthorized attacker to     perform spoofing over a network. (CVE-2026-42897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
320863	Security Updates for Microsoft Exchange Server (June 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
316010	Security Updates for Microsoft Exchange Server (May 2026)	Nessus	Windows : Microsoft Bulletins	Local	medium

Detections

Analytics

CVE-2026-42897

medium

Tenable Plugins

high

medium