CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

Overview

Severity
High (CVSS 8.1)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Category
Spoofing
Exploit Status
Actively Exploited
Exploitation Likelihood
Detected
Patch Tuesday
2026-May
Released
2026-05-14

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

FAQ

How could an attacker exploit this vulnerability? An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. How do I protect my Exchange Server from this vulnerability? The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default. If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service. You can find more information and instruction in the Exchange blog here. Why are there no links to updates in the Security Update Table? Microsoft is supplying a temporary mitigation for this vulnerability through the Exchange Emergency Mitigation Service. We are working on developing and testing a more permanent fix which we will provide when it meets our quality standards.

Affected Products (4)

ESU

  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Exchange Server 2019 Cumulative Update 15

Server Software

  • Microsoft Exchange Server Subscription Edition RTM

Acknowledgments

Anonymous

Revision History

  • 2026-05-14: Information published.