CVE-2026-42897
CWE-79Published: May 14, 2026· Updated: May 15, 2026
Official Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Risk Analysis
This medium-severity cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthenticated attacker to perform spoofing over a network. With a CVSS score of 6.1, it can lead to credential theft or other client-side attacks. Its presence in CISA's KEV catalog indicates confirmed active exploitation, making it an urgent concern.
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. It is remotely exploitable, but requires user interaction.
Apply the latest security updates for Microsoft Exchange Server, including versions 2016 and 2019, to mitigate this XSS vulnerability. Educate users about phishing and suspicious links to reduce the risk of client-side attacks.
Technical Analysis
CVE-2026-42897 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CISA has added CVE-2026-42897 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
News & Research Mentioning CVE-2026-42897
The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microsoft Patches Exploited Exchange Server Vulnerability appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:6dee2300f03ba6043abdb9c64638436233a2d7ef838f62971c8f979b1dcba4b8]
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions. The post Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:480a9903e95f83573fc52cd43bbed0aa03e5132cee560e0f856c61ed8a0b2f52]
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks aga [xlite_meta score:48 src:CISA Alerts xlite_fp:8f0d5bd54e46fb5cfabc3cb725c0c0ee2419ebe6537724dd750301af3e78921a]
Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue. " [xlite_meta score:53 src:The Hacker News xlite_fp:95ff4d745c5e9e7617e09fd7122676eb6df7eb4870ce004c59f429fb6feda4ea]
All References (2)
Quick Facts
Known Threat Actors
Related CVEs (CWE-79)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-42897 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1