CVE-2026-42897

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition versions prior to 15.02.2562.043

Description Microsoft Exchange Server contains a cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation in Outlook Web Access (OWA). An unauthorized remote attacker can exploit this by sending a specially crafted email; if a user opens the message in OWA, arbitrary JavaScript executes within the victim's authenticated browser session. This allows the attacker to perform spoofing, hijack sessions, steal credentials, and read mailboxes. The issue has been actively exploited in the wild, targeting government, telecommunications, finance, and aerospace sectors. Technical exploitation involves sending a malformed HTML payload that the OWA render engine treats as trusted interface logic.

Recommendations For Microsoft Exchange Server 2016, 2019, and Subscription Edition, enable the Exchange Emergency Mitigation Service (EEMS) to automatically apply temporary protections. For air-gapped or isolated environments, run the Exchange On-Premises Mitigation Tool (EOMT) using the command .EOMT.ps1 -CVE "CVE-2026-42897" for a single server, or Get-ExchangeServer | Where-Object { $ .ServerRole -ne "Edge" } | .EOMT.ps1 -CVE "CVE-2026-42897" for all servers. Install the June 2026 security updates for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14/CU15. As a temporary mitigation, restrict external access to the OWA interface and advise users to use the Outlook desktop client instead of the web interface.