undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Products covered
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server Subscription Edition RTM
Remediation
Install KB5128896. Install KB5128897. Install KB5128898. Install KB5128895.
Vendor-listed fixes
15.02.1748.055
15.02.1544.050
15.01.2507.077
15.02.2562.056
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.