CVE-2026-42897

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Overview

State: PUBLISHED
Assigner (CNA): microsoft
CVSS severity: HIGH
CVSS score: 8.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Effective score: 8.1 / 10 HIGH source: CNA overview
MSRC score: 8.1 / 10 HIGH MS rating: Critical · Spoofing
CWE(s): CWE-79
Reserved: 2026-05-01
Published: 2026-05-14 07:00 UTC
Last updated: 2026-07-14 07:00 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json
Linked Threat: CVE-2026-42897 — Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Microsoft Exchange Server Cross-Site Scripting Vulnerability
Vendor / project: Microsoft
Product: Microsoft
Date added to KEV: 2026-05-15
Remediation due: 2026-05-29
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-14 18:16:49 UTC
NVD last modified: 2026-05-15 19:35:52 UTC
NVD CVSS v3.1: 8.1 / 10 HIGH source: secure@microsoft.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0840 (probability of exploitation in next 30 days)
EPSS percentile: 92.42% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-30343
Assigner: microsoft
Published: May 14, 2026, 5:00:36 PM
Updated: May 26, 2026, 4:56:41 PM
EUVD base score (CVSS 3.1): 8.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
EUVD-reported EPSS: 8.8200
Vendors: Microsoft
Products: Microsoft Exchange Server 2016 Cumulative Update 23 (-)

Microsoft Exchange Server 2019 Cumulative Update 15 (-)

Microsoft Exchange Server 2019 Cumulative Update 14 (-)

Microsoft Exchange Server Subscription Edition RTM (-)
Aliases: GHSA-3c39-338m-m4vp

ENISA description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

EUVD references (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-15 03:02 UTC (source: CVRF).

MS severity: Critical
Impact: Spoofing
MS CVSS base score: 8.1 / 10 (temporal 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Exploit assessment: Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected
Release: 2026-May

Microsoft remediations / KB articles (8)

5094144 — Vendor Fix / Security Update (fixed build 15.01.2507.069)
https://support.microsoft.com/help/5094144 — None Available / 5094144
5094142 — Vendor Fix / Security Update (fixed build 15.02.1544.041)
https://support.microsoft.com/help/5094142 — None Available / 5094142
5094140 — Vendor Fix / Security Update (fixed build 15.02.1748.046)
https://support.microsoft.com/help/5094140 — None Available / 5094140
5094139 — Vendor Fix / Security Update (fixed build 15.02.2562.043)
https://support.microsoft.com/help/5094139 — None Available / 5094139

Microsoft FAQ (1)

How could an attacker exploit this vulnerability?

An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

How do I protect my Exchange Server from this vulnerability?

The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default. If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service. You can find more information and instruction in the Exchange blog here.

Am I protected from this vulnerability if I am running Internet Explorer or Edge with Internet Explorer Mode?

No, because Content Security Policy (CSP) is not supported by Internet Explorer nor Microsoft Edge using Internet Explorer Mode. To stay protected, please make sure to not use Internet Explorer (Mode) to access OWA.

Update 7/14/2026

Microsoft recommends installing the July 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability and related CVE-2026-55008 vulnerability. Mitigations that have been applied either using the Exchange Emergency Mitigation Service or the EOMT script can be removed after July 2026 update is installed. Please see the Exchange blog post for more information.

Affected products (4)

Vendor	Product	Versions	Platforms
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	`-` (affected)	x64-based Systems
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	`-` (affected)	x64-based Systems
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	`-` (affected)	x64-based Systems
Microsoft	Microsoft Exchange Server Subscription Edition RTM	`-` (affected)	x64-based Systems

Affected products — CPE 2.3 (40) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:microsoft:exchange_server:-:*:*:*:subscription:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

Microsoft Exchange Server Spoofing Vulnerability vendor-advisorypatch

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Microsoft Exchange Server Spoofing Vulnerability vendor-advisory, patch

Web references (17)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
None Available msrc
None Available msrc
None Available msrc
5094139 msrc
https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild tenable:www.proofpoint.com
https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/ tenable:www.bleepingcomputer.com
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897 tenable:www.cisa.gov
https://www.cve.org/CVERecord?id=CVE-2026-42897 tenable:www.cve.org
https://www.darkreading.com/vulnerabilities-threats/microsoft-exchange-zero-day-no-patch tenable:www.darkreading.com
https://www.first.org/epss/ tenable:www.first.org
https://www.securityweek.com/microsoft-warns-of-exchange-server-zero-day-exploited-in-the-wild/ tenable:www.securityweek.com
https://nvd.nist.gov/vuln/detail/CVE-2026-42897 tenable:nvd.nist.gov
https://securityaffairs.com/192204/security/cve-2026-42897-microsoft-confirms-active-exploitation-of-exchange-server-zero-day.html tenable:securityaffairs.com
https://securityaffairs.com/192240/hacking/u-s-cisa-adds-a-flaw-in-microsoft-exchange-server-to-its-known-exploited-vulnerabilities-catalog.html tenable:securityaffairs.com
https://thehackernews.com/2026/05/microsoft-warns-of-two-actively.html tenable:thehackernews.com
https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html tenable:thehackernews.com

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 secure@microsoft.com MitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cwe	`CWE-79`	no local data	2026-05-18 09:55 UTC
cve	`CVE-2026-42897`	no local data	2026-05-18 09:55 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Required Action

CISA KEV (via KEVin)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-05-29

2026-05-18 09:55 UTC
CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

web:patchapalooza.com

Why are there no links to updates in the Security Update Table? Microsoft is supplying a temporary mitigation for this vulnerability through the Exchange Emergency Mitigation Service. We are working on developing and testing a more permanent fix which we will provide when it meets our quality standards.

2026-05-17 21:38 UTC
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897

web:techcommunity.microsoft.com

On May 14, 2026 , Microsoft disclosed CVE-2026-42897 , a reported vulnerability affecting Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email to a user.

2026-05-17 21:38 UTC
CVE-2026-42897 Exchange OWA Mitigation M2: What Admins Must Verify

web:windowsforum.com

The mitigation name administrators should verify for CVE-2026-42897 is M2. Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition are affected at any update level, while Exchange Online is not affected.

2026-05-17 21:38 UTC
Microsoft warns of Exchange zero-day flaw exploited in attacks

web:www.bleepingcomputer.com

On Thursday, Microsoft shared mitigations for a high-severity Exchange Server vulnerability exploited in attacks that allow threat actors to execute arbitrary code via cross-site scripting (XSS ...

2026-05-17 21:38 UTC
Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation

web:www.forbes.com

Updated May 17: This article, originally published May 16, has been updated to include further details on the emergency mitigation process recommended after the CVE-2026-42897 Microsoft Exchange ...

2026-05-17 21:38 UTC
Exchange Server CVE-2026-42897: Exploited Zero-Day Flaw

web:www.it-connect.tech

Learn how CVE-2026-42897 affects Exchange Server, which versions are vulnerable, and how to mitigate the zero-day before a patch arrives.

2026-05-17 21:38 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-17 21:38 UTC
CISA orders urgent patching of exploited Microsoft Exchange flaw - MSN

web:www.msn.com

Confirmed active exploitation: CISA verified real-world attacks on CVE-2026-42897 , a spoofing flaw in Microsoft Exchange, and mandated federal agencies to patch by a set deadline. Zero user ...

2026-05-17 21:38 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42897.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42897",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T03:55:55.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-15T00:00:00.000Z",
            "value": "CVE-2026-42897 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 14",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 15",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-05-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T17:13:44.533Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
        }
      ],
      "title": "Microsoft Exchange Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-42897",
    "datePublished": "2026-05-14T17:00:36.515Z",
    "dateReserved": "2026-04-30T22:35:54.967Z",
    "dateUpdated": "2026-05-16T03:55:55.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}