Unrated severityNVD Advisory· Published Feb 10, 2026· Updated Apr 10, 2026
Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-21527
Description
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Affected products
5- Microsoft/Microsoft Exchange Server 2016 Cumulative Update 23v5Range: 15.01.0.0
- Microsoft/Microsoft Exchange Server 2019 Cumulative Update 14v5Range: 15.02.0.0
- Microsoft/Microsoft Exchange Server 2019 Cumulative Update 15v5Range: 15.02.0.0
- Microsoft/Microsoft Exchange Server Subscription Edition RTMv5Range: 15.02.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527mitrevendor-advisorypatch
News mentions
1- ZDI-26-194: Microsoft Exchange InterceptorSmtpAgent Improper Input Validation Security Feature Bypass VulnerabilityZero Day Initiative · Mar 16, 2026