CVE-2026-42897 – Critical Cross‑Site Scripting in Microsoft Exchange Server
Key takeaways
- Critical XSS flaw (CWE‑79) in on‑prem Exchange Server 2016/2019.
- Active exploitation observed in the wild; attackers can run arbitrary JavaScript in Outlook Web Access (OWA) by sending a crafted email.
- The vulnerability is listed in the CISA KEV catalog – prioritize detection and mitigation now.
- No public patch for older cumulative updates; apply the latest cumulative updates or follow Microsoft’s temporary mitigations.
- Monitor OWA logs, block suspicious HTML content, and enforce strict email filtering.
Overview
On May 14 2026, Microsoft disclosed CVE-2026-42897, a critical cross‑site scripting (XSS) vulnerability in on‑premises Exchange Server. The flaw is being actively exploited in the wild, targeting Outlook Web Access (OWA). It allows an unauthenticated attacker to inject arbitrary JavaScript into the victim’s browser session, enabling credential theft, session hijacking, and UI spoofing. The vulnerability is listed in the CISA KEV program, underscoring the urgency for defenders.
Technical Details
- Vulnerability type: Improper neutralization of input during web page generation (CWE‑79 – XSS).
- Attack vector: A malicious email containing specially crafted HTML is sent to a victim. When the email is opened in OWA, the embedded JavaScript executes in the context of the user’s authenticated session. No attachment or external link is required.
- Impact: The script can read cookies, CSRF tokens, and perform actions on behalf of the user, effectively spoofing the OWA interface and stealing credentials.
- CVSS scores:
- Microsoft rating: 8.1 (High) –
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. - NIST rating: 6.1 (Medium) –
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
- Microsoft rating: 8.1 (High) –
- Scope: Affects on‑premises Exchange Server 2016 and 2019 (all cumulative updates) and the Subscription edition. Exchange Online is not impacted.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS (Microsoft) | 8.1 (High) |
| CVSS (NIST) | 6.1 (Medium) |
| CWE | CWE‑79 (XSS) |
| CISA KEV | Yes |
The high CVSS score reflects the potential for confidentiality and integrity compromise via credential theft and session hijacking. While the vulnerability does not provide remote code execution, the ability to run arbitrary JavaScript in a trusted browser session makes it a critical threat.
Affected Products
- Microsoft Exchange Server 2016 (all cumulative updates)
- Microsoft Exchange Server 2019 (all cumulative updates)
- Exchange Server Subscription (including SE)
For the complete list of affected versions and updates, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-42897.
Actionable Insights
- Detect: Enable OWA logging and alert on HTML payloads containing
<script>tags or suspicious JavaScript patterns. - Block: Deploy a transport rule in Exchange to strip or block email bodies that contain script elements.
- Restrict: If feasible, temporarily disable OWA for high‑risk accounts or enforce MFA for OWA logins.
- Update: Apply the latest cumulative updates for Exchange 2016/2019 as soon as they are available. Microsoft’s advisory provides a temporary mitigation checklist.
- Monitor: Watch for anomalous authentication events, especially successful OWA logins from unfamiliar IPs shortly after a suspicious email is delivered.
Sample PowerShell command to verify your Exchange build version:
Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion
Remediation & Mitigation
- Patch – Install the most recent cumulative update for your Exchange version (2016 CU 23, 2019 CU 14, or later). Microsoft’s advisory lists the exact fixes.
- Apply Microsoft’s temporary mitigation –
- Disable external OWA access for accounts that do not require it.
- Enforce strict HTML sanitization via Exchange transport rules.
- Use the Exchange Health Checker (see Microsoft documentation) to verify configuration.
- Network‑level controls – Deploy web‑application firewalls (WAF) or reverse proxies that can detect and block malicious script injections in OWA traffic.
- Credential hygiene – Force password resets for accounts that have accessed OWA since the disclosure, and enable multi‑factor authentication (MFA) for all OWA users.
- Continuous monitoring – Subscribe to the live threat feed for CVE-2026-42897 on https://vulnsocial.com to receive real‑time indicators of compromise.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897
- https://vulnsocial.com/cve/CVE-2026-42897
#CVE202642897 #Microsoft #Exchange #XSS #CISAKEV #Security