Technical Information

An unauthenticated attacker can exploit this Microsoft Exchange Server cross-site scripting vulnerability by sending a specially crafted email that, when opened in Outlook Web Access and interacted with by the victim, executes arbitrary JavaScript in the browser context, enabling spoofing attacks and potential theft of sensitive information.

Patch release date: Jun 09, 2026
Further information on this vulnerability is available at : CVE-2026-42897