Microsoft Exchange Zero-Day Exploited via XSS in Outlook on the web

Microsoft has issued mitigations for a high-severity zero-day vulnerability in Exchange Server, actively exploited in the wild. BleepingComputer reports that this flaw allows threat actors to execute arbitrary code through cross-site scripting (XSS) attacks, specifically targeting users of Outlook on the web.

This isn’t a theoretical risk; it’s a live attack. The XSS vector means an attacker can inject malicious scripts into trusted web pages viewed by Outlook on the web users. This bypasses standard browser same-origin policies, potentially leading to session hijacking, credential theft, or further arbitrary code execution within the user’s browser context.

Attackers are clearly leveraging the ubiquity of Exchange and Outlook on the web as a prime target. Exploiting XSS in such a critical communication platform gives them a direct path into user sessions, making it a high-value entry point for lateral movement or data exfiltration within an organization.