CVE-2026-55008

This vulnerability is like a “switchable display” inside a website. An attacker can add a malicious script so the Exchange pages you load look normal, but can trick your browser into showing forged content or capturing information.

Think of it as someone putting a counterfeit sign on your office door—visually convincing, but meant to mislead people and possibly steal what they type or click.

This matters if you run Microsoft Exchange Server with the specific versions listed in the findings (Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14, Exchange Server 2019 Cumulative Update 15, or Exchange Server Subscription Edition RTM). The issue affects the Exchange web experience because it can inject scripts into web pages.

Reachability is a key gate: this is a network-based problem and needs a user to interact, so it’s a risk when the affected Exchange web pages can be reached by an attacker and users visit them.

This is RED because it’s a critical web vulnerability in widely used enterprise software and it can directly manipulate what users see in their browsers. Even without confirmed public exploit code, XSS-based spoofing is exactly the kind of attack that can lead to credential or session theft.

Act immediately: apply the vendor fixes for your exact Exchange version.