A critical cross-site scripting vulnerability in Microsoft Exchange Server allows unauthenticated attackers to conduct spoofing attacks, potentially compromising user sessions and communications.

This vulnerability involves improper neutralization of input during web page generation (CWE-79), which enables cross-site scripting. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates that an unauthenticated attacker can exploit this via the network, provided they can induce a user to interact with a malicious link or page.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a user session. This can lead to the theft of session tokens, unauthorized access to sensitive internal email communications, and the ability to perform actions on behalf of the victim, which poses a severe risk to organizational data integrity and confidentiality. The CVSS score of 9.6 highlights the critical nature of this flaw, primarily due to its impact on the integrity and confidentiality of the Exchange environment.

Immediate Action: Apply the specific security updates provided by Microsoft for each affected Cumulative Update version immediately. Refer to the official Microsoft Security Update Guide for the corresponding patch binaries.

Proactive Monitoring: Monitor server access logs for suspicious URL patterns or unexpected scripts being injected into web-based interfaces.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common cross-site scripting payloads targeting Exchange web interfaces.

Public Exploit Available: exploit_available (unknown)

Given the critical CVSS severity and the ubiquity of Exchange Server, administrators should prioritize applying the provided patches across all affected versions. Failure to remediate this vulnerability leaves the environment exposed to sophisticated spoofing and session compromise attacks.