Introduction
Attackers are actively exploiting a cross-site scripting vulnerability in Microsoft Exchange Server's Outlook Web Access to execute arbitrary JavaScript in authenticated user sessions, and Microsoft has not yet released a permanent fix. Exploitation is confirmed in the wild and only temporary mitigations exist, so on-premises Exchange administrators need to act on incomplete remediation rather than wait for a clean patch.
Technical information
CVE-2026-42897 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects the Outlook Web Access (OWA) component of Microsoft Exchange Server. The root cause is that OWA does not properly sanitize input before rendering it in the pages it serves, which makes cross-site scripting possible.
Attack flow
The exploitation path is straightforward:
- The attacker crafts an email containing a malicious payload.
- The attacker sends the email to a targeted user whose organization runs an on-premises Exchange Server.
- The recipient opens the email in Outlook Web Access in their browser.
- When specific interaction conditions are met, the payload executes arbitrary JavaScript in the context of the victim's authenticated browser session.
Because the JavaScript runs in the victim's session, the attacker can access session data, perform actions on the user's behalf, and potentially exfiltrate sensitive information.
CVSS 3.1 breakdown
The vulnerability has a base score of 8.1. The individual metrics are:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network | Exploitable remotely across the internet |
| Attack Complexity | Low | No specialized conditions required, and repeatable success expected |
| Privileges Required | None | No prior authorization needed to initiate the attack |
| User Interaction | Required | Victim must open the crafted email in OWA |
| Confidentiality Impact | High | Total loss of confidentiality for affected resources |
| Integrity Impact | High | Malicious modification of data is possible |
| Availability Impact | None | No disruption to service availability |
An attack that needs no privileges, has low complexity, and hits confidentiality and integrity hard is particularly dangerous, even though the victim still has to open the email.
Affected systems and versions
Microsoft has confirmed that all update levels of the following on-premises Exchange Server products are vulnerable:
| Product | Impacted Versions | Permanent Update Available |
|---|---|---|
| Microsoft Exchange Server Subscription Edition | All update levels including RTM | No |
| Microsoft Exchange Server 2019 | All update levels including CU 14 and CU 15 | No |
| Microsoft Exchange Server 2016 | All update levels including CU 23 | No |
Exchange Online (cloud-hosted) is not listed as affected. The vulnerability is specific to on-premises deployments, which accounted for approximately 16 percent of Exchange mailboxes worldwide as of late 2023.
Mitigation
No permanent security update is available, and Microsoft did not release any security update for Exchange Server in May 2026. Organizations must apply temporary mitigations instead.
Exchange Emergency Mitigation Service (recommended)
The fastest route is the Exchange Emergency Mitigation Service (EM Service), which automatically applies a mitigation designated M2. M2 uses an IIS URL Rewrite configuration to block specific patterns of malicious HTTP requests associated with this vulnerability.
The EM Service is enabled by default on Exchange Server 2016 and 2019 servers running the September 2021 Cumulative Update or later. Administrators should confirm that the mitigation has been applied by checking the server's applied mitigations list with PowerShell. If the EM Service is disabled, Microsoft strongly recommends enabling it immediately.
Exchange On Premises Mitigation Tool (air-gapped environments)
For environments that cannot reach the cloud-based EM Service, Microsoft provides the Exchange On Premises Mitigation Tool. Administrators can download the latest version of the script and run it from an elevated Exchange Management Shell to apply the mitigation manually on one or more servers.
Known side effects
The mitigation causes two OWA regressions that administrators should warn their users about:
| Feature | Issue | Workaround |
|---|---|---|
| OWA Print Calendar | Fails to work completely | Copy data, take screenshots, or use the Outlook Desktop client |
| Inline Images | May not display correctly in the OWA reading pane | Send images as email attachments or use the Outlook Desktop client |
Threat intelligence
Microsoft's exploitability assessment confirms that exploitation of CVE-2026-42897 has been detected in the wild. The vulnerability was not publicly disclosed before it was exploited, so attackers were using it as a zero-day before Microsoft published its advisory on May 14, 2026.
As of this writing, CISA has not added CVE-2026-42897 to its Known Exploited Vulnerabilities catalog. Organizations should not read the missing KEV entry as a sign of low risk. The vendor itself has confirmed active exploitation.
The available security advisories do not attribute the exploitation to a specific threat actor or describe any campaign.
References
- Microsoft Security Response Center: CVE-2026-42897
- NVD Entry: CVE-2026-42897
- Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 (Microsoft Community Hub)
- No Exchange Server Security Updates for May 2026 (Microsoft Community Hub)
- Exchange Emergency Mitigation Service Documentation (Microsoft Learn)
- CISA Known Exploited Vulnerabilities Catalog
- How Will Enterprises Handle Changes in Exchange Server SE (TechTarget)
