Critical Microsoft Exchange Server Vulnerability Actively Exploited in Attacks

Cybersecuritynews •Abinaya • May 15, 2026

Microsoft issued an urgent security alert regarding a newly discovered vulnerability in Exchange Server that is currently being exploited in the wild. Tracked as CVE-2026-42897, this critical spoofing flaw carries a high CVSS 3.1 severity score of 8.1 and directly impacts on-premises email infrastructure. Threat actors are actively exploiting this network-based weakness to compromise organizational […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of CVE-2026-42897 in Microsoft Exchange Server Microsoft has disclosed a critical vulnerability, CVE-2026-42897, affecting on-premises Exchange Server versions 2016, 2019, and Subscription Edition. This zero-day flaw allows attackers to execute arbitrary JavaScript via specially crafted emails opened in Outlook Web Access (OWA), with a CVSS score of 8.1. Active exploitation of this vulnerability has been confirmed, prompting Microsoft to recommend immediate mitigation measures. The Exchange Emergency Mitigation Service (EEMS) is available for automatic protection, while the Exchange On-premises Mitigation Tool (EOMT) can be used in air-gapped environments. No patches are currently available, and the vulnerability does not affect Exchange Online. Organizations are advised to enable EEMS or apply EOMT to reduce exposure until a permanent fix is released. Microsoft plans to provide updates for affected Exchange versions, but only for customers enrolled in the Extended Security Update (ESU) program. 39 sources 70

Extracted Entities

CVEs (1)

CVE-2026-42897

Platforms (1)

Microsoft Exchange Server