CVE-2026-62914

This flaw is like a “dirty input” problem in the web pages Exchange shows to users. If someone has the ability to interact with Exchange as an authorized user, they can potentially make the web interface display misleading content that looks real—enough to trick people into handing over credentials or taking unsafe actions. In a business, that can quickly turn into account takeover and follow-on disruption.

This matters if your business runs Microsoft Exchange Server on the affected versions listed (Exchange 2016 Cumulative Update 23, Exchange 2019 Cumulative Update 14 or 15, or Exchange Server Subscription Edition RTM/subscription edition). It’s not mainly about “anyone on the internet” automatically breaking in; the findings describe spoofing that depends on an attacker being able to interact with Exchange web UI as an authorized attacker. In other words, it’s most relevant when an attacker has some legitimate access/ability to trigger the web page behavior and then mislead a user.

This is RED because a new patch was released and the reported activity has drawn attention to this issue, including reporting that references the Lazarus group in connection with the update. While there is no dated confirmation in the provided sources that exploitation is widespread, you should treat unpatched Exchange as a high-risk target since this type of flaw focuses on spoofing inside a trusted system.

1. Identify exact deployment details

   • Confirm the Exchange Server type (Exchange 2016, Exchange 2019, Exchange Server Subscription Edition) and the installed build/Cumulative Update.
   • Match your installed build to the vendor’s fixed-build mapping for CVE-2026-62914.

2. Confirm whether you are already fixed

   • If you are already on or above the fixed build for your branch, you can stop and document the installed version.
   • If you are below the fixed build, you are exposed.

3. Patch to the fixed version (per your branch)

   • Exchange Server 2016 Cumulative Update 23 → upgrade so it is fixed in 15.01.2507.072
   • Exchange Server 2019 Cumulative Update 14 → upgrade so it is fixed in 15.02.1544.044
   • Exchange Server 2019 Cumulative Update 15 → upgrade so it is fixed in 15.02.1748.049
   • Exchange Server Subscription Edition RTM (and subscription edition) → upgrade so it is fixed in 15.02.2562.046

4. Validate after patching

   • Re-check the Exchange build number to ensure the update installed correctly.
   • Review Exchange web/application logs around user interface activity for signs of spoofing attempts (for example, unusual page-generation errors or suspicious user sessions).

5. If patching must wait (short-term containment)

   • Restrict access to Exchange web interfaces to only the intended users and networks.
   • Tighten monitoring for any suspicious authorized users and unusual UI actions, since the described scenario depends on an authorized attacker being able to interact with Exchange’s web UI.

6. Ongoing monitoring

   • Watch for alerts involving suspicious UI-driven behavior (spoofing-like activity) and take immediate action if you see unexpected logins, unusual session patterns, or users reporting “fake” prompts inside Exchange.

Severity is rated HIGH (CVSS 7.3) in the provided material. The weakness category is CWE-79, which aligns with improper neutralization of input during web page generation (a cross-site scripting style issue), leading here to spoofing inside Microsoft Exchange Server’s web interface.

Findings summary: no KEV listing; no dated public press claim of clear exploitation; no public exploit code on record. However, PULSE indicates new press attention tied to a patch and references the Lazarus group, which increases the practical urgency. Exploitation maturity is therefore not confirmed in the provided sources, but the exposure involves trusted web UI content, which can enable credential theft or session abuse when an attacker can interact as an authorized attacker.

EPSS is reported as 0.3% with a flat trend; per the instructions, this prediction is not used as the basis for urgency when other signals (press/threat-actor attention and patch availability) drive the RED decision. KEV is not listed, so there is no CISA-confirmed exploitation indicator from the provided findings.