Exchange Server Still Needs Love

Those brave souls still clinging to on-premise Exchange have been gifted a cross-site scripting vulnerability that turns opening an email into a session-hijacking adventure. Apparently, clicking a link in Outlook Web Access is now a high-stakes gamble for anyone using these systems. We are currently relying on the emergency mitigation service to rewrite URLs while we wait for a permanent patch that will inevitably break something else. Checking the mailbox has become a weary act of defiance against sanity. Staying safe involves hoping the automated rewrite actually works for once.