.NET Denial of Service Vulnerability
CVE-2026-120796
Summary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Products covered
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Exchange Server Subscription Edition RTM
Remediation
Install KB5094144. Install KB5094142. Install KB5094140. Install KB5094139.
Vendor-listed fixes
15.01.2507.069
15.02.1544.041
15.02.1748.046
15.02.2562.043
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Updated by Microsoft Security Response Center
The vendor changed the advisory after it was first published.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.