Microsoft Exchange Critical Vulnerability Actively Exploited: CVE-2026-42897 (High Severity)

Introduction

Microsoft has issued an urgent security advisory regarding CVE-2026-42897, a critical vulnerability impacting on-premises Microsoft Exchange Server deployments. This flaw is classified as a spoofing vulnerability within the Outlook Web Access (OWA) component. It carries a high severity rating, showing its potential impact on affected organizations.

Threat actors are actively exploiting CVE-2026-42897 in the wild. This active exploitation targets organizations before a permanent patch becomes widely available, which requires immediate attention. The ongoing exploitation shows the persistent challenges in maintaining secure communication platforms. Organizations using on-premises Exchange are at immediate risk, requiring prompt action to implement mitigations and bolster their breach detection capabilities. Microsoft Exchange Online, which provides cloud-based email services, is not affected by this vulnerability, limiting exposure to environments utilizing on-premises Exchange infrastructure.

What is CVE-2026-42897 and how does it affect Microsoft Exchange?

CVE-2026-42897 is a critical spoofing vulnerability impacting the Outlook Web Access (OWA) component of on-premises Microsoft Exchange Server deployments. The flaw originates from improper input neutralization during web page generation within OWA. This condition enables a cross-site scripting (XSS) vulnerability, which allows arbitrary client-side script execution in the user's browser context.

Attackers exploit this vulnerability by sending specially crafted malicious emails to target victims. If a user opens such an email in Outlook Web Access and meets specific interaction conditions, malicious JavaScript can be executed within their browser session. This unauthorized script execution facilitates network-level spoofing, session manipulation, and potential data theft. The attack requires low complexity, making it a highly attractive target for threat actors seeking to compromise user sessions without requiring administrative privileges.

Which Microsoft Exchange versions are impacted by CVE-2026-42897?

The CVE-2026-42897 vulnerability impacts multiple major versions of on-premises Microsoft Exchange Server. Specifically, the flaw affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. This includes all update levels for these affected versions.

Microsoft Exchange Online, the cloud-based email service, is not vulnerable to CVE-2026-42897. Exposure is confined to organizations that host their Exchange email infrastructure on their own premises. Organizations running older, unsupported versions of Exchange Server are likely to face greater risks, as they may not receive even emergency mitigations. This makes continuous supply-chain risk monitoring necessary in complex enterprise environments.

Exploitation and Impact

Microsoft has confirmed active exploitation of CVE-2026-42897 in the wild. Threat actors are using this vulnerability to compromise user sessions and manipulate browser-based data. The primary attack mechanism involves social engineering through malicious emails, which, upon interaction in OWA, trigger the XSS payload.

The impact of successful exploitation includes:

  • Sensitive Data Theft: Arbitrary JavaScript execution can allow attackers to access and exfiltrate sensitive information displayed in the OWA session, including emails, contact lists, or other confidential data.
  • Session Hijacking: The vulnerability enables session manipulation, potentially allowing attackers to hijack authenticated user sessions. This can lead to unauthorized access to other internal resources accessible via the compromised session.
  • Network-Level Spoofing: Attackers can perform network-level spoofing, potentially impersonating legitimate users or services within the victim's network context to facilitate further lateral movement.
  • Circumvention of Security Controls: By executing JavaScript within the user's browser, attackers may bypass certain client-side security mechanisms.

Active exploitation means threat actors are already incorporating this flaw into their attack chains. Organizations may become aware of such activity through underground forum intelligence or specialized dark web monitoring service platforms that track new exploits and discussions among cybercriminal groups. Proactive breach detection and incident response capabilities are critical in such scenarios to identify and contain compromises quickly. Insights from a cyber threat intelligence platform can provide early warnings and contextual information about threat actor tactics using vulnerabilities like CVE-2026-42897.

How can organizations mitigate CVE-2026-42897?

To mitigate immediate risk from CVE-2026-42897, Microsoft has deployed the Exchange Emergency Mitigation Service (EEMS). This service automatically applies protection rule M2.1.x for supported and connected Exchange Server systems. This automatic application provides an important temporary defense against active exploitation attempts.

For administrators operating disconnected or air-gapped environments, manual application of the mitigation is necessary. This involves downloading and running the official Exchange on-premises mitigation script with elevated privileges. This manual process ensures that protection is extended to environments that do not benefit from automatic updates. Details on Microsoft's patching cycle, concerning zero-day exploits, can often be found in advisories like the information provided in the blog post on Microsoft Zero-Day Patch.

While the emergency mitigation offers temporary protection, it introduces limited operational side effects:

  • Broken Outlook Web Access print calendar functionality.
  • Issues with inline image rendering in emails.

Despite these disruptions, Microsoft strongly advises keeping the mitigation enabled until a permanent fix is released. A full security update for Exchange Server Subscription Edition is currently under development. However, older versions such as Exchange Server 2016 and Exchange Server 2019 will only receive patches under the Extended Security Update (ESU) Program (Period 2). This means organizations relying on these older versions will need to be enrolled in the ESU program to receive full protection. For broader context on Microsoft's patching schedule, insights from posts covering events such as May 2026 Patch Tuesday are often relevant.

Organizations are strongly advised to consider upgrading and modernizing their Exchange infrastructure. This proactive approach ensures compatibility with future security updates and reduces long-term exposure to similar vulnerabilities. While the current mitigation addresses CVE-2026-42897, an older vulnerability like CVE-2026-32201 SharePoint Spoofing demonstrates the recurring nature of spoofing attacks across Microsoft products and the importance of a complete update strategy.

Remediation Actions

  • Immediately apply Microsoft's Exchange Emergency Mitigation Service (M2.1.x) on all affected on-premises Exchange servers to block active exploitation attempts.
  • For air-gapped or disconnected environments, manually download and run the official Exchange on-premises mitigation tool script using an elevated (admin) PowerShell or management shell.
  • Restrict and closely monitor access to Outlook Web Access (OWA), especially external or untrusted network access, until a permanent patch becomes available.
  • Implement strong email filtering and anti-phishing controls to block malicious or suspicious emails that may contain crafted XSS payloads.
  • Enable and enforce multi-factor authentication (MFA) for all Exchange users to reduce the risk of session hijacking, even if initial compromise occurs.
  • Monitor Exchange and OWA logs for unusual JavaScript execution patterns, spoofing behavior, or abnormal session activity, which can indicate potential breach detection.
  • Temporarily disable or restrict non-essential OWA features, such as calendar printing and inline image rendering, if recommended in Microsoft guidance, to reduce the attack surface.
  • Keep all systems updated with the latest cumulative updates (CU) for Exchange Server 2016, 2019, or Subscription Edition, as these updates often contain important security fixes preceding major vulnerability patches.

Technical Takeaways

  • CVE-2026-42897 is a high-severity spoofing vulnerability affecting on-premises Microsoft Exchange OWA, stemming from an XSS condition.
  • The vulnerability enables arbitrary JavaScript execution, leading to potential sensitive data theft, session hijacking, and network-level spoofing.
  • Exchange Server 2016, 2019, and Subscription Edition are affected; Microsoft Exchange Online is not.
  • Microsoft has deployed the Exchange Emergency Mitigation Service (EEMS) (M2.1.x) to provide temporary protection, with manual application required for air-gapped systems.
  • Operational impacts of EEMS include issues with OWA print calendar functionality and inline image rendering, but Microsoft recommends keeping it enabled.
  • Permanent patches for older versions (2016, 2019) will be available only through the Extended Security Update (ESU) Program (Period 2).
  • Proactive monitoring, strong email filtering, MFA, and a strategy for breach detection are critical in responding to active exploitation.