Improper neutralization of input during web page generation

CVE-2026-55008 is a stored cross-site scripting flaw in Outlook Web Access (OWA) — the browser-facing mail client that ships with Microsoft Exchange Server. An attacker crafts an email whose HTML body carries JavaScript that OWA fails to neutralize during rendering. When the recipient opens (or in some previewers, merely selects) the message in OWA, the payload executes inside the OWA origin. Affected: Exchange Server Subscription Edition RTM and Exchange Server 2019 CU15, patched in the July 2026 cumulative security updates (KB5103212 and companion packages).

The vendor rating of CRITICAL / 9.6 is defensible and we're keeping it. The CVSS vector shows S:C — scope changed — which is the tell that this isn't a normal reflected XSS. Payloads running in the OWA origin can read the user's mailbox, exfiltrate messages, plant persistent mailbox rules, chain into token/cookie theft, and — depending on how OWA proxies backend calls — pivot into EWS/EAS. Exchange is *the* identity- and communications-adjacent server in most enterprises; downgrading an OWA RCE-equivalent on the basis of UI:R would be malpractice.

Why this verdict

• Role multiplier — Exchange is canonical high-value infrastructure. OWA session compromise = mailbox exfil + inbox-rule persistence + internal phishing from a trusted sender. Blast radius per user is a full mailbox; blast radius per admin is fleet-adjacent. Floor is CRITICAL by the deployment-role rule.
• Unauthenticated remote trigger. Attacker only needs to send an email — no credentials, no prior foothold, no internal position. Scope-changed XSS makes this effectively an RCE-equivalent inside the OWA origin.
• UI:R is not real friction here. The user interaction required is *reading email*, the primary function of the application. This is not a 'convince the user to click a weird link' scenario.
• No compensating tuning available short of patching. Microsoft explicitly notes no configuration-level workaround; SEG filtering is best-effort against novel sanitizer bypasses.
• Installed base is enormous. ~180k internet-facing OWA endpoints per Shodan, plus internal-only deployments. Sibling CVE-2026-42897 already saw exploitation in this exact product family two months ago — attacker attention is warm.

Why not higher?

There is no severity bucket above CRITICAL in the noisgate schema. Within CRITICAL, we shave 0.2 off the vendor 9.6 because UI:R is genuinely required (contrast a zero-click preview-pane bug) and thick-client Outlook users are unaffected at the trigger step — not enough to change the bucket.

Why not lower?

Downgrading to HIGH would require either a non-critical role (Exchange is not that) or meaningful population narrowing (there isn't any — every unpatched Exchange org with OWA users is exposed). The UI:R argument fails because 'user opens email' is the trivial base rate of mail. Sibling exploitation in the same product family within the last quarter forecloses any 'wait and see' posture.

1. Deploy the July 2026 Exchange SU now — KB5103212 for SE RTM, the July 2026 SU for Exchange 2019 CU15. Per noisgate mitigation SLA for CRITICAL, mitigation deadline is ≤3 days; treat this as the mitigation *and* the remediation. Exchange SU rollouts require post-install schema/RBAC steps — do not skip the Setup /PrepareSchema follow-through if applicable.
2. Restrict OWA to VPN or Conditional Access — If you can't patch in the 3-day window, block external /owa and /ecp at the reverse proxy or F5/Netscaler in front of Exchange. Reduces the reachable-victim population to LAN/VPN users only. Deploy within hours, not days.
3. Force Outlook thick-client for privileged users during the window — Executives, IT admins, and finance should have OWA access temporarily disabled via Set-CASMailbox -OWAEnabled $false until the SU is deployed. Removes the trigger vector for the highest-blast-radius mailboxes.
4. Hunt for post-exploitation IoCs preemptively — Run Get-InboxRule and Get-Mailbox -ResultSize Unlimited | Get-InboxRule across the org, looking for new forwarding rules, ForwardingSMTPAddress, or rules that hide messages by moving to RSS Feeds/Deleted Items. Also review Exchange admin audit log for unexpected RBAC changes.
5. Tune SEG to strip aggressive HTML — Have Proofpoint/Mimecast/EOP quarantine emails with <svg>, <math>, <foreignObject>, or heavily-obfuscated <style> payloads until the fleet is patched. Not a replacement for the SU — mutation-XSS bypasses are cheap.

Run on each Exchange server directly as an account in the Organization Management role (Exchange admin). From the Exchange Management Shell: .\Check-CVE-2026-55008.ps1. The script inspects installed build numbers against the July 2026 SU threshold. Read-only, no changes made.

#requires -Version 5.1
# Check-CVE-2026-55008.ps1
# Determines whether the local Exchange server is patched against CVE-2026-55008.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    $exchSetup = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup' -ErrorAction Stop
} catch {
    Write-Output 'UNKNOWN - Exchange Server not detected on this host'
    exit 2
}

$installedVersion = [Version]$exchSetup.MsiProductMajor.ToString() + '.' + $exchSetup.MsiProductMinor.ToString() + '.' + $exchSetup.MsiBuildMajor.ToString() + '.' + $exchSetup.MsiBuildMinor.ToString()
Write-Output "Installed Exchange build: $installedVersion"

# July 2026 SU minimum-safe builds (verify against KB5103212 / KB5094140 release notes for exact numbers)
$fixedBuilds = @{
    'ExchangeSE'      = [Version]'15.2.2562.17'   # SE RTM + July 2026 SU (KB5103212) — confirm exact
    'Exchange2019CU15' = [Version]'15.2.1748.30'  # 2019 CU15 + July 2026 SU — confirm exact
}

# Detect edition
$edition = if ($exchSetup.MsiProductMajor -eq 15 -and $exchSetup.MsiProductMinor -eq 2 -and $exchSetup.MsiBuildMajor -ge 2500) {
    'ExchangeSE'
} elseif ($exchSetup.MsiProductMajor -eq 15 -and $exchSetup.MsiProductMinor -eq 2) {
    'Exchange2019CU15'
} else {
    'UnsupportedOrLegacy'
}

Write-Output "Detected edition: $edition"

if (-not $fixedBuilds.ContainsKey($edition)) {
    Write-Output 'VULNERABLE - unsupported/legacy Exchange edition, no fix available in this branch'
    exit 1
}

$required = $fixedBuilds[$edition]
if ($installedVersion -ge $required) {
    Write-Output "PATCHED - $installedVersion >= $required"
    exit 0
} else {
    Write-Output "VULNERABLE - $installedVersion < $required (July 2026 SU not installed)"
    exit 1
}

Sources

1. Microsoft KB5103212 — Exchange SE RTM July 2026 SU
2. Microsoft KB5094140 — Exchange 2019 CU15 companion SU
3. ZDI — July 2026 Security Update Review
4. SecurityWeek — Microsoft July 2026 Patch Tuesday coverage
5. Microsoft Community Hub — sibling CVE-2026-42897 advisory
6. Help Net Security — Exchange CVE-2026-42897 exploitation context
7. CVE Details — Exchange XSS history
8. The Hacker News — On-prem Exchange exploitation via crafted email