Microsoft CVE-2018-8159: Microsoft Exchange Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information.
To exploit the vulnerability, an attacker could send a specially crafted email message containing a specific malicious script. The user would have to apply a highlight to the script for it to be activated.
The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests.