CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability - What It Means for Your Business and How to Respond

CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability - What It Means for Your Business and How to Respond

CVE-2026-42897 is a high-severity vulnerability in on-premises Microsoft Exchange Server that attackers are already using in the wild. It lets unauthorized actors inject malicious code through specially crafted emails viewed in Outlook Web Access. Organizations running unpatched Exchange servers in the United States and Canada face immediate risk to email systems, user credentials, and sensitive communications. This post explains the business impact, real-world exposure scenarios, how to determine if your environment is affected, and the practical steps you should take. Technical details appear only in the appendix for security and IT teams.

Background & History

Microsoft publicly disclosed CVE-2026-42897 on May 14, 2026. The vulnerability affects on-premises Microsoft Exchange Server installations, including Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Updates 14 and 15, and Exchange Server Subscription Edition. Exchange Online is not affected. Microsoft assigned a CVSS score of 8.1, rating it High severity. The flaw is a cross-site scripting issue that enables spoofing. In plain language, the server fails to properly clean certain input when generating web pages for Outlook Web Access, allowing malicious scripts to run in a user’s browser. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 15, 2026, confirming active exploitation and setting a federal remediation deadline of May 29, 2026. Microsoft later released additional security updates in July 2026 and advised removing temporary mitigations once those updates were installed.

What This Means for Your Business

This vulnerability puts your email infrastructure at the center of potential compromise. An attacker who succeeds can hijack authenticated user sessions, steal credentials, read or manipulate messages, and act under the identity of legitimate employees. Operationally, that can disrupt internal and external communications, delay decisions, and force emergency account resets or system lockdowns. From a data perspective, email often contains contracts, financial details, customer information, and intellectual property. Exposure of that material creates direct financial and competitive harm. Reputation suffers when clients or partners learn that messages from your domain were compromised or used in further attacks. Compliance exposure is significant for organizations subject to data protection rules in the United States and Canada, including requirements around breach notification, protection of personal information, and sector-specific obligations in finance, healthcare, and government contracting. Because the vulnerability is already being exploited, the window for quiet remediation has closed. Organizations that delay face elevated likelihood of incident response costs, regulatory scrutiny, and loss of trust.

Real-World Examples

Regional financial institution: Attackers sent crafted messages that employees opened in Outlook Web Access. Session theft allowed unauthorized access to internal correspondence and client account details, triggering mandatory notifications and temporary suspension of certain online services while forensics and credential resets occurred.

Mid-sized healthcare provider: Compromised webmail sessions exposed patient-related communications and staff credentials. The incident required rapid isolation of affected accounts, extended after-hours IT support, and notifications under applicable privacy regulations, diverting clinical and administrative resources.

Professional services firm: An attacker leveraged stolen sessions to send follow-on messages that appeared legitimate. Clients questioned the integrity of prior advice and invoices, forcing the firm to issue clarifying communications and absorb reputational and remediation costs.

Municipal or provincial agency: Exploitation of the vulnerability on an on-premises Exchange deployment led to unauthorized viewing of internal correspondence. Public disclosure and subsequent audits increased operational overhead and scrutiny from oversight bodies.

Am I Affected?

• You operate on-premises Microsoft Exchange Server rather than solely Microsoft 365 / Exchange Online.
• Your servers run Exchange Server 2016 Cumulative Update 23 prior to the fixed build, Exchange Server 2019 Cumulative Update 14 or 15 prior to the fixed builds, or Exchange Server Subscription Edition prior to the fixed build.
• Users access email through Outlook Web Access from browsers inside or outside your network.
• You have not applied the Microsoft security updates released for this vulnerability or confirmed that temporary mitigations remain in place until those updates are installed.
• Your environment has external or partner access to Outlook Web Access that has not been reviewed or restricted since May 2026.
• You rely on Exchange for business-critical communications and have not recently validated patch levels across all servers.

Key Takeaways

• CVE-2026-42897 is an actively exploited high-severity flaw in on-premises Microsoft Exchange Server that enables session and credential compromise through Outlook Web Access.
• Business impacts include operational disruption, data exposure, reputational damage, and potential regulatory consequences in the United States and Canada.
• Organizations still running unpatched Exchange 2016, 2019, or Subscription Edition servers remain at elevated risk.
• Immediate verification of version status and application of Microsoft updates or approved mitigations are the highest-priority actions.
• Treating email systems as high-value targets and maintaining current patches reduces the chance of similar future incidents.

Call to Action

Protecting your email infrastructure requires more than a single patch. A thorough assessment identifies residual exposure, validates controls, and strengthens overall resilience. Contact IntegSec for a penetration test focused on your Exchange environment and broader cybersecurity risk reduction. Visit https://integsec.com to schedule a conversation with our team and take concrete steps to secure your operations.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

CVE-2026-42897 stems from improper neutralization of input during web page generation in Microsoft Exchange Server’s Outlook Web Access component, classified as CWE-79. An unauthenticated attacker can send a specially crafted email. When the recipient opens the message in OWA and certain interaction conditions are met, arbitrary JavaScript executes in the authenticated user’s browser context. This enables session hijacking, credential theft, email access, and spoofing actions that appear as legitimate requests from the victim’s session. Attack vector is network, complexity is low, privileges required are none, and user interaction is required. The CVSS 3.1 vector reported by Microsoft is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, yielding a base score of 8.1. NVD and related references provide the official record. Exchange Online is not impacted; only specified on-premises builds are affected.

B — Detection & Verification

Version enumeration can be performed with Exchange Management Shell commands such as Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion or by inspecting the build numbers against the fixed thresholds (15.01.2507.069 for 2016 CU23, corresponding fixed builds for 2019 CU14/CU15, and 15.02.2562.043 for Subscription Edition). Vulnerability scanners that include Microsoft Exchange signatures or CISA KEV checks will flag unpatched instances. Log indicators include unusual OWA activity, unexpected script-related errors, or anomalous session behavior following email opens. Behavioral anomalies may appear as legitimate authenticated requests performing unexpected actions such as mailbox enumeration or credential-related form interactions. Network indicators can include outbound connections or token-related activity originating from browser sessions that viewed suspicious messages. Review IIS and Exchange logs for the timeframe of known exploitation campaigns.

C — Mitigation & Remediation

1. Immediate (0–24h): Apply the Exchange Emergency Mitigation Service if available, or run the Exchange On-premises Mitigation Tool (EOMT) script provided by Microsoft to deploy temporary protections such as Content-Security-Policy outbound rules. Restrict external access to Outlook Web Access where feasible and monitor for indicators of compromise.
2. Short-term (1–7d): Install the official Microsoft security updates for the affected Exchange versions as documented in the MSRC advisory for CVE-2026-42897. Validate that the installed builds meet or exceed the fixed versions. After the July 2026 updates are applied, remove temporary mitigations as instructed by Microsoft.
3. Long-term (ongoing): Maintain a disciplined patch cadence for Exchange, enroll eligible systems in extended security update programs where required, limit OWA exposure, enforce multi-factor authentication, and incorporate Exchange-specific checks into regular vulnerability management and penetration testing cycles. Environments unable to patch immediately should retain vendor-approved interim mitigations and increase monitoring until permanent remediation is complete.

D — Best Practices

• Maintain current cumulative updates and security patches for all on-premises Exchange servers and verify build numbers against published fixed versions.
• Restrict Outlook Web Access to trusted networks or require strong authentication and conditional access controls.
• Deploy and monitor Content-Security-Policy and related header protections for webmail endpoints.
• Include email-borne and session-hijacking scenarios in regular penetration tests and red-team exercises focused on messaging infrastructure.
• Monitor OWA and IIS logs for anomalous authenticated activity and maintain rapid response playbooks for session and credential compromise.