CVE-2026-21527: Microsoft Exchange Server UI misrepresentation spoofing vulnerability

CVE-2026-21527 · Severity: medium · CVSS 6.5 · Published 2026-02-10

Microsoft Exchange Server, the widely used corporate email and calendaring platform, contains a vulnerability that allows attackers to misrepresent information in the user interface. This could allow an unauthorized person to spoof communications or system alerts, potentially tricking employees into trusting malicious content or providing sensitive information. Successful exploitation could lead to unauthorized access to data or a loss of trust in internal communications.

Technologies: Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, Microsoft Exchange Server Subscription Edition. Vendors: Microsoft.

Quick answers

Is CVE-2026-21527 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-21527 being exploited in the wild.
How severe is CVE-2026-21527?
Medium severity, with a CVSS score of 6.5, published 10 February 2026.
Which products and versions are affected?
Microsoft Exchange Server Subscription Edition versions up to (excluding) 15.02.2562.037.
Is there a fix for CVE-2026-21527?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21527 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-21527?
Check whether you run Microsoft Exchange Server 2016, Microsoft Exchange Server 2019 or Microsoft Exchange Server Subscription Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A spoofing vulnerability exists in Microsoft Exchange Server due to the improper validation of syntactic correctness of input and insufficient verification of data authenticity (CWE-345, CWE-1286). This leads to a User Interface (UI) Misrepresentation of Critical Information (CWE-451). An unauthenticated attacker can exploit this over the network to present misleading information to users. The vulnerability affects Exchange Server 2016, 2019, and the Subscription Edition. Microsoft has released updates to address this issue, and users are advised to upgrade to the latest cumulative updates or the fixed version of the Subscription Edition (15.02.2562.037 or later).

Affected products

  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Exchange Server Subscription Edition versions up to (excluding) 15.02.2562.037

Timeline

  • 2026-02-10: disclosed: Initial disclosure by Microsoft
  • 2026-02-10: advisory: MSRC advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.