On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email

Microsoft disclosed CVE-2026-42897, a cross-site scripting vulnerability in on-premises Exchange Server being actively exploited.

• •CVSS score 8.1 affects Exchange Server 2016, 2019, and Subscription Edition
• •Attackers send crafted emails executing arbitrary JavaScript in Outlook Web Access
• •Temporary mitigation available via Exchange Emergency Mitigation Service or EOMT tool
• •Exchange Online is not affected; permanent patch in development
• •CISA added to Known Exploited Vulnerabilities catalog with May 29, 2026 deadline

This summary was automatically generated by AI based on the original article and may not be fully accurate.