{"id":"CVE-2026-21527","aliases":["EUVD-2026-7340","GHSA-87gj-v6h3-c8p3"],"status":"published","title":"Microsoft Exchange Server Spoofing Vulnerability","description":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.08071,"percentile":0.94877,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1286","CWE-345","CWE-451"],"published":"2026-02-10T17:51:30Z","modified":"2026-08-19T16:26:00Z","products":[{"vendor":"microsoft","product":"exchange_server"},{"vendor":"microsoft","product":"exchange_server_subscription_edition"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 23"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 14"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 15"},{"vendor":"microsoft","product":"microsoft exchange server subscription edition rtm"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21527"},{"url":"https://github.com/advisories/GHSA-87gj-v6h3-c8p3"}],"sources":{"cve":[{"id":"CVE-2026-21527","title":"Microsoft Exchange Server Spoofing Vulnerability","description":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","status":"published","published":"2026-02-10T17:51:30.28Z","modified":"2026-08-19T16:26:00.908Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-451","CWE-345","CWE-1286"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-7340","description":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","status":"published","published":"2026-02-10T17:51:30Z","modified":"2026-08-19T16:26:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T18:01:44.172516Z"}],"ghsa":[{"id":"GHSA-87gj-v6h3-c8p3","title":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows...","description":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","status":"published","published":"2026-02-10T18:30:42Z","modified":"2026-02-10T18:30:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:06:07.875228Z"}],"nvd":[{"id":"CVE-2026-21527","description":"User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","status":"published","published":"2026-02-10T18:16:35.093Z","modified":"2026-06-17T10:18:47.19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-345","CWE-451","CWE-1286"],"updated_at":"2026-11-02T14:12:05.908608Z"}]}}