6.5

CVE-2026-21527

Microsoft Exchange Server Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Exchange Server Version2016 Updatecumulative_update_23
Microsoft ≫ Exchange Server Version2019 Updatecumulative_update_14
Microsoft ≫ Exchange Server Version2019 Updatecumulative_update_15
Microsoft ≫ Exchange Server Subscription Edition Version < 15.02.2562.037
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.62% 0.945
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secure@microsoft.com 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-1286 Improper Validation of Syntactic Correctness of Input

The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CWE-451 User Interface (UI) Misrepresentation of Critical Information

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527
Vendor Advisory