On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email
Summary: Microsoft disclosed CVE-2026-42897, a CVSS 8.1 cross-site scripting flaw in on-premises Exchange Server that allows an unauthorized attacker to perform spoofing over a network, and tagged it with an "Exploitation Detected" assessment. An attacker can trigger it by sending a crafted email that, when opened in Outlook Web Access and subject to certain interaction conditions, executes arbitrary JavaScript in the browser context; Microsoft issued a temporary mitigation through the Exchange Emergency Mitigation Service, added CISA to its KEV catalog on May 15, 2026 with a May 29, 2026 mitigation deadline for FCEB agencies, and released patches on June 9, 2026.
What you should know: CISA added this to its KEV catalog on May 15, 2026 and gave federal civilian agencies until May 29 to mitigate, yet Microsoft did not ship patches until June 9 - leaving a window in which the only defense was a mitigation service that air-gapped environments cannot use.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-42897
- Related
- CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · May 15, 2026