CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

CVE-2026-42897 is a spoofing vulnerability in Microsoft Exchange Server, rated Critical by Microsoft, with a CVSS 3.1 base score of 8.1 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft reports that it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 15 May 2026, with a remediation deadline of 29 May 2026 for US federal agencies. The EPSS model estimates a 70.66% probability of exploitation activity in the next 30 days, higher than 99% of all scored vulnerabilities. Microsoft released the fix on 14 May 2026, outside Patch Tuesday, delivered through 4 security updates (KB5094144, KB5094142, KB5094140, KB5094139). It affects 4 products in 2 product families (ESU, Server Software).

Key facts

CVE ID

CVE-2026-42897

Severity

High CVSS 8.1

Microsoft severity

Critical

Impact

Spoofing

Exploited in the wild

Yes

Publicly disclosed

No

Exploitation likelihood

Detected

Weakness

CWE-79

EPSS

70.66% (percentile 99%)

CISA KEV

Listed 15 May 2026, due 29 May 2026

Released

14 May 2026

Last updated

14 July 2026

Patch Tuesday

May 2026 Patch Tuesday

Product families

ESU, Server Software

CVSS score and vector

Microsoft scores CVE-2026-42897 at 8.1 (temporal 7.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

How do I protect my Exchange Server from this vulnerability?

The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default. If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service. You can find more information and instruction in the Exchange blog here.

Am I protected from this vulnerability if I am running Internet Explorer or Edge with Internet Explorer Mode?

No, because Content Security Policy (CSP) is not supported by Internet Explorer nor Microsoft Edge using Internet Explorer Mode. To stay protected, please make sure to not use Internet Explorer (Mode) to access OWA.

Update 7/14/2026

Microsoft recommends installing the July 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability and related CVE-2026-55008 vulnerability. Mitigations that have been applied either using the Exchange Emergency Mitigation Service or the EOMT script can be removed after July 2026 update is installed. Please see the Exchange blog post for more information.

Affected products (4)

ESU

Server Software

Security updates (4)

• KB5094144 (Security Update)
• KB5094142 (Security Update)
• KB5094140 (Security Update)
• KB5094139 (Security Update)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added

15 May 2026

Federal due date

29 May 2026

Ransomware use

Unknown

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

VulnCheck KEV

Date added

14 May 2026

Ransomware use

Unknown

Independent sources

6

• 14 May 2026 · api.msrc.microsoft.com
• 14 May 2026 · docs.google.com
• 14 May 2026 · msrc.microsoft.com
• 15 May 2026 · cisa.gov
• 27 May 2026 · proofpoint.com
• 7 July 2026 · asec.ahnlab.com
• 28 July 2026 · proofpoint.com
• 7 August 2026 · recordedfuture.com
• 11 September 2026 · securelist.ru
• 28 October 2026 · ti.qianxin.com
• 29 October 2026 · ti.qianxin.com

Public exploits (1)

• atiilla/CVE-2026-42897 · added 15 May 2026

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

• atiilla/CVE-2026-42897 · 5 stars

NIST NVD data

NVD status

Analyzed

NVD CVSS

8.1 (HIGH)

NVD weakness

CWE-79

Published to NVD

14 May 2026

NVD last modified

15 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 (Mitigation, Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897 (US Government Resource)

Acknowledgments

• Anonymous

Revision history

Related vulnerabilities

Other Microsoft Exchange Server vulnerabilities

• CVE-2026-118208: Microsoft Exchange Server Spoofing Vulnerability (High, CVSS 7.1, November 2026)
• CVE-2026-118207: Microsoft Exchange Server Remote Code Execution Vulnerability (High, CVSS 8.8, November 2026)
• CVE-2026-118157: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 7.2, November 2026)
• CVE-2026-118154: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 8.8, November 2026)
• CVE-2026-118153: Microsoft Exchange Server Denial of Service Vulnerability (High, CVSS 7.5, November 2026)
• CVE-2026-118151: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 7.2, November 2026)
• CVE-2026-118150: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 8.8, November 2026)
• CVE-2026-118149: Microsoft Exchange Server Remote Code Execution Vulnerability (High, CVSS 8.8, November 2026)
• CVE-2026-118152: Microsoft Exchange Server Spoofing Vulnerability (Medium, CVSS 6.5, November 2026)
• CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability (Critical, CVSS 9.3, October 2026)
• CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 8.8, October 2026)
• CVE-2026-87696: Microsoft Exchange Server Elevation of Privilege Vulnerability (High, CVSS 7.5, October 2026)

More from the May 2026 Patch Tuesday

• CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-33835: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-33837: Windows TCP/IP Local Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-33841: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-35417: Windows Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-40397: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-40398: Windows Remote Desktop Services Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-35416: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-34329: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2026-33834: Windows Event Logging Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-33838: Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: May 2026 Patch Tuesday · May 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-42897
• NIST NVD: CVE-2026-42897
• CVE.org record: CVE-2026-42897
• CISA KEV catalog: CVE-2026-42897