CVE-2026-62914

This flaw is like a “dirty input” problem in the web pages Exchange shows to users. If someone has the ability to interact with Exchange as an authorized user, they can potentially make the web interface display misleading content that looks real—enough to trick people into handing over credentials or taking unsafe actions. In a business, that can quickly turn into account takeover and follow-on disruption.

This matters if your business runs Microsoft Exchange Server on the affected versions listed (Exchange 2016 Cumulative Update 23, Exchange 2019 Cumulative Update 14 or 15, or Exchange Server Subscription Edition RTM/subscription edition). It’s not mainly about “anyone on the internet” automatically breaking in; the findings describe spoofing that depends on an attacker being able to interact with Exchange web UI as an authorized attacker. In other words, it’s most relevant when an attacker has some legitimate access/ability to trigger the web page behavior and then mislead a user.

This is RED because a new patch was released and the reported activity has drawn attention to this issue, including reporting that references the Lazarus group in connection with the update. While there is no dated confirmation in the provided sources that exploitation is widespread, you should treat unpatched Exchange as a high-risk target since this type of flaw focuses on spoofing inside a trusted system.