Back Securityaffairs.Co

CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero

Securityaffairs.Co •Pierluigi Paganini • May 15, 2026

Microsoft warned that attackers are exploiting a new Exchange Server zero-day vulnerability, tracked as CVE-2026-42897, in the wild. Microsoft warned that threat actors are actively exploiting a new Exchange Server zero-day vulnerability tracked as CVE-2026-42897 (CVSS score 8.1). The vulnerability is an improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of CVE-2026-42897 in Microsoft Exchange Server Microsoft has disclosed a critical vulnerability, CVE-2026-42897, affecting on-premises Exchange Server versions 2016, 2019, and Subscription Edition. This zero-day flaw allows attackers to execute arbitrary JavaScript via specially crafted emails opened in Outlook Web Access (OWA), with a CVSS score of 8.1. Active exploitation of this vulnerability has been confirmed, prompting Microsoft to recommend immediate mitigation measures. The Exchange Emergency Mitigation Service (EEMS) is available for automatic protection, while the Exchange On-premises Mitigation Tool (EOMT) can be used in air-gapped environments. No patches are currently available, and the vulnerability does not affect Exchange Online. Organizations are advised to enable EEMS or apply EOMT to reduce exposure until a permanent fix is released. Microsoft plans to provide updates for affected Exchange versions, but only for customers enrolled in the Extended Security Update (ESU) program. 26 sources 70

Extracted Entities

CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)