CVE-2026-42897
Microsoft Exchange Server Cross-Site Scripting Vulnerability
Description
CVE-2026-42897 is a HIGH severity cross-site scripting (XSS) vulnerability in Microsoft Exchange Server that allows an unauthenticated remote attacker to perform spoofing over the network, carrying a CVSS 3.1 score of 8.1. The flaw arises from improper neutralization of user-controllable input during web page generation in the Exchange Server web interface, meaning an attacker can inject crafted script content that the server reflects back into a victim's browser session in the context of the trusted Exchange origin. Exploitation requires user interaction (a victim must visit or interact with attacker-supplied content) but does not require any privilege or prior authentication. A successful exploit lets the attacker hijack the victim's authenticated Exchange session, read or send mail as the victim, harvest credentials, and pivot deeper into Microsoft 365 / Active Directory integrated services. CISA added CVE-2026-42897 to the KEV catalog on May 15, 2026, with a remediation deadline of May 29, 2026, and the EPSS score of 0.123 (93.96 percentile) signals high observed exploitation pressure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2016; 2019 |
| microsoft | exchange server subscription edition | < 15.02.2562.043 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 covers the case where an application accepts user-controllable input and renders it into a web page sent to other users without first applying context-appropriate output encoding. In CVE-2026-42897 the Microsoft Exchange Server web layer reflects attacker-controlled content into Exchange-served HTML — typically Outlook on the Web or admin endpoints — so a crafted payload executes JavaScript inside the trusted exchange.contoso.com origin and inherits the victim's session cookies, anti-CSRF tokens, and OAuth bearer tokens. The exploitation pattern is classic for spoofing chains: the script body forges UI elements, redirects to attacker infrastructure, or silently issues authenticated mailbox API calls that appear to originate from the victim.
Learn more: CWE-79 — Cross-site Scripting
Impact Analysis
CVE-2026-42897 is rated HIGH with a CVSS 3.1 score of 8.1 and the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N — remotely exploitable over the network with low attack complexity, no privileges required, but a single user interaction needed (clicking a link, opening a crafted message, or visiting an attacker-controlled page). Confidentiality and Integrity are both rated High while Availability is None, which is consistent with an XSS that yields full takeover of the victim's Exchange session: mailbox contents, archived messages, contacts, and any internal documents shared by email are exposed (Confidentiality), and the attacker can send messages, modify mail rules, set forwarding addresses, or change profile settings as the victim (Integrity). Because Exchange is the corporate mail and identity hub for most Microsoft estates, a successful spoofing payload is rarely the final goal — it is the first stage of business-email-compromise, internal phishing waves with trusted-sender provenance, and credential harvesting that pivots into Microsoft 365, Entra ID, and on-premises Active Directory. The EPSS score of 0.123 in the 93.96 percentile, combined with KEV listing, indicates that active campaigns are weaponizing this XSS today.
Exploit Maturity
Active Exploitation: CISA added CVE-2026-42897 to the KEV catalog on May 15, 2026, with a federal remediation deadline of May 29, 2026, confirming observed exploitation against unpatched Exchange Server deployments. Vendor Advisory: Microsoft Security Response Center has published patch and mitigation guidance at the MSRC update guide for CVE-2026-42897; Microsoft also recommends keeping the Exchange Emergency Mitigation Service enabled to receive rapid interim mitigations. Exploitation Probability: The EPSS score of 0.123 (93.96 percentile) places CVE-2026-42897 in the top 7 percent of all tracked CVEs by predicted exploitation likelihood — high for an XSS, reflecting Exchange's value as a pre-authenticated attack surface inside the corporate perimeter. Practical risk: historical Exchange XSS chains (notably the ProxyLogon-era flaws) have been weaponized as initial-access vectors for ransomware and nation-state intrusions within days of public disclosure, so defenders should treat any unpatched 2016 or 2019 Exchange instance as an imminent intrusion target.
Remediation
- Install the May 2026 Microsoft Exchange security update. Follow the patch matrix in the MSRC advisory for CVE-2026-42897 and apply the cumulative update appropriate to your Exchange Server 2016 or Exchange Server 2019 build. Confirm post-patch with
Get-ExchangeServer | Format-List Name, AdminDisplayVersionand Microsoft's HealthChecker script. - Enable the Exchange Emergency Mitigation Service. Ensure the Exchange Emergency Mitigation Service (EM service) is running and reachable; Microsoft uses it to push interim URL-rewrite and request-blocking rules ahead of full patch cycles for fast-moving Exchange issues.
- Hunt for spoofing-stage indicators of compromise. Review IIS request logs on Exchange servers (
%SystemDrive%\inetpub\logs\LogFiles\W3SVC*) for OWA, ECP, and EWS requests containing script payloads (<script,onerror=,javascript:), unusualRefererheaders, and mass-send patterns from internal mailboxes. Check Exchange transport rules and inbox rules for unexpected forwarding entries, hidden rules, and recently created service mailboxes. - Constrain Exchange web exposure. Place OWA, ECP, and EWS behind a reverse proxy or Web Application Firewall with XSS protections enabled, restrict ECP (admin endpoints) to management networks only, and require Conditional Access / MFA for all interactive Exchange logons.
- Apply long-term CWE-79 mitigation principles to dependent applications. Use a strict Content-Security-Policy header (
default-src 'self'; script-src 'self'with nonces) on internally hosted Exchange-adjacent web apps to limit the blast radius of any future Exchange XSS, and subscribe to MSRC and CISA notifications so future Exchange CVEs are remediated within the BOD 22-01 timeline.
Technical Details
CVE-2026-42897 is a CWE-79 cross-site scripting flaw in the web-page generation logic of Microsoft Exchange Server 2016 and 2019. The vulnerable component reads attacker-influenced input from an HTTP request — typically a URL parameter, header value, or mail-rendering field handled by Outlook on the Web or an Exchange management endpoint — and writes the value into the response HTML without applying the context-appropriate encoding (HTML-entity encoding for body content, JavaScript-string encoding for inline <script> contexts, or URL encoding for attribute contexts). When a victim browses the resulting page, the attacker-supplied script body runs inside the trusted Exchange origin and inherits the victim's session cookies, OAuth tokens, and anti-forgery state, which is enough to drive any Exchange Web Services or REST API call on the victim's behalf. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N captures the operational shape precisely: an unauthenticated attacker over the network can trigger the flaw with low complexity, but they need a victim to interact (open the crafted message, click the crafted link, or load the malicious page) before the script executes. The May 2026 cumulative update remediates the issue by adding the missing output encoding on the affected response path; the Exchange Emergency Mitigation Service can also deploy interim URL-rewrite rules that strip the dangerous parameters before patching is complete.
Frequently Asked Questions
Is CVE-2026-42897 being actively exploited?
Yes. CISA added CVE-2026-42897 to the KEV catalog on May 15, 2026, with a remediation deadline of May 29, 2026, which only happens for vulnerabilities CISA has observed exploitation against. The EPSS score of 0.123 (93.96 percentile) places it in the top 7 percent of CVEs by predicted exploitation likelihood.
What products are affected by CVE-2026-42897?
Microsoft Exchange Server 2016 and Microsoft Exchange Server 2019 are affected, along with the legacy unmarked Exchange Server line referenced in the NVD record. Refer to the Microsoft MSRC advisory for the exact patched cumulative-update levels.
How do I fix CVE-2026-42897?
Install the May 2026 Microsoft Exchange security update, ensure the Exchange Emergency Mitigation Service is enabled to pick up interim mitigations, hunt IIS and Exchange transport logs for spoofing-stage indicators, restrict OWA/ECP exposure behind WAF and Conditional Access, and enforce MFA for all Exchange logons.
How severe is CVE-2026-42897?
CVE-2026-42897 is rated HIGH with a CVSS 3.1 score of 8.1, with High impact on Confidentiality and Integrity. Severity is amplified by the lack of authentication required, Exchange's central role in enterprise identity, KEV listing, and the EPSS 93.96-percentile exploitation probability — defenders should treat any unpatched Exchange 2016 or 2019 server as a critical-priority remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.