KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-42897
8.1
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityMicrosoft Exchange Server Cross-Site Scripting Vulnerability
VendorMicrosoft
ProductMicrosoft
Date added2026-05-15
Due date2026-05-29
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-79
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Descriptions
KEV: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
NVD: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-26 16:43 UTC
Wall time180s
Searches12
Component defaultyes
Sources
https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-subscription-edition-rtm-june-09-2026-kb5094139-d9713301-1e65-40f9-a14a-2c7b8ae711d1
https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
https://github.com/atiilla/CVE-2026-42897
https://github.com/PacketPursuit/CVE-2026-42897
https://github.com/microsoft/CSS-Exchange/issues/2539
https://hivesecurity.gitlab.io/blog/cve-2026-42897-exchange-server-owa-xss-zero-day/
https://ctipilot.ch/entities/CVE-2026-42897/
https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/
https://www.kiteworks.com/secure-email/cve-2026-42897-exchange-zero-day-email-risk/
https://blog.senthorus.ch/posts/cve_2026_42897/
https://launchweld.com/blog/2026-05-16/cve-2026-42897-exchange-xss-zero-day/
https://techcommunity.microsoft.com/blog/exchange/released-june-2026-exchange-server-security-updates/4524491
https://www.youtube.com/watch?v=lQgehcjgR7o
https://www.apolocybersecurity.com/en/blog-posts/microsoft-exchange-owa-zero-day-cve-2026-42897-mitigation-eems
https://socprime.com/blog/cve-2026-42897-analysis/
https://www.penligent.ai/hackinglabs/cve-2026-42897/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-42897
https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/
https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/EOMT/Mitigations/CVE-2026-42897.ps1
https://www.cycognito.com/blog/emerging-threat-cve-2026-42897-microsoft-exchange-owa-cross-site-scripting-via-crafted-email/
https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498
https://www.darkreading.com/vulnerabilities-threats/microsoft-exchange-zero-day-no-patch
https://www.securityweek.com/microsoft-patches-exploited-exchange-server-vulnerability/
https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
https://github.com/atiilla/CVE-2026-42897
https://github.com/PacketPursuit/CVE-2026-42897
https://github.com/microsoft/CSS-Exchange/issues/2539
https://hivesecurity.gitlab.io/blog/cve-2026-42897-exchange-server-owa-xss-zero-day/
https://ctipilot.ch/entities/CVE-2026-42897/
https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/
https://www.kiteworks.com/secure-email/cve-2026-42897-exchange-zero-day-email-risk/
https://blog.senthorus.ch/posts/cve_2026_42897/
https://launchweld.com/blog/2026-05-16/cve-2026-42897-exchange-xss-zero-day/
https://techcommunity.microsoft.com/blog/exchange/released-june-2026-exchange-server-security-updates/4524491
https://www.youtube.com/watch?v=lQgehcjgR7o
https://www.apolocybersecurity.com/en/blog-posts/microsoft-exchange-owa-zero-day-cve-2026-42897-mitigation-eems
https://socprime.com/blog/cve-2026-42897-analysis/
https://www.penligent.ai/hackinglabs/cve-2026-42897/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-42897
https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/
https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/EOMT/Mitigations/CVE-2026-42897.ps1
https://www.cycognito.com/blog/emerging-threat-cve-2026-42897-microsoft-exchange-owa-cross-site-scripting-via-crafted-email/
https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498
https://www.darkreading.com/vulnerabilities-threats/microsoft-exchange-zero-day-no-patch
https://www.securityweek.com/microsoft-patches-exploited-exchange-server-vulnerability/
QC notes
warn component_extraction: Component 'Microsoft Exchange Server Outlook Web Access (OWA) web interface — specifically the improper HTML content sanitization logic during email body rendering that allows stored cross-site scripting via crafted email content' matches or contains product name 'Microsoft' — no specific component identified
Hunting hypothesis agent
Hunt browser proxy and WAF logs for OWA sessions querying GitHub Commit Search API and POSTing to image CDN paths matching /assets/v1_<base64> — OWAReaper C2 from exploitation via onload= JavaScript hidden in email social-media icon URLs.
Research details
ComponentMicrosoft Exchange Server Outlook Web Access (OWA) web interface — specifically the improper HTML content sanitization logic during email body rendering that allows stored cross-site scripting via crafted email content
PreconditionsExploitation of CVE-2026-42897 requires a Microsoft Exchange Server on-premises deployment (2016, 2019, or Subscription Edition) with Outlook Web Access (OWA) enabled, which is the default configuration for all supported Exchange versions. Exchange Online (Microsoft 365) is not affected. The attacker sends a specially crafted email containing obfuscated JavaScript within the HTML body or MIME content to a target user's Exchange mailbox. No authentication, prior access, or administrative privileges on the Exchange server are required — the attacker only needs knowledge of the victim's email address to deliver the payload. The vulnerability stems from improper input sanitization in OWA's web page generation: when Exchange Server renders email content into HTML for the OWA web interface (both the reading pane and full message view), it fails to adequately neutralize embedded script content. When the recipient opens the crafted email in OWA, and certain interaction conditions are met (Microsoft has not publicly disclosed the specific trigger conditions, which may involve user interaction such as clicking, hovering, or the automatic rendering of specific HTML elements), the attacker's arbitrary JavaScript executes in the browser context of the victim's authenticated OWA session. This enables session hijacking (stealing session cookies), mailbox data exfiltration (reading/copying emails), creation of mailbox forwarding rules for persistent access, and spoofing within the OWA interface. The vulnerability was confirmed as actively exploited in the wild as a zero-day before Microsoft disclosed it on May 14, 2026. Microsoft released emergency mitigations via the Exchange Emergency Mitigation Service (EEMS, enabled by default since September 2021) which deploys a Content-Security-Policy header injection rule (M2.1.x) via IIS outbound URL Rewrite to block inline script execution. The permanent security update was released on June 9, 2026. Internet Explorer and Microsoft Edge IE Mode clients are NOT protected by the CSP-based mitigation. agent
Deliverycrafted email message with embedded XSS payload sent to the target user's Exchange mailbox; exploitation triggers when the recipient opens the message in Outlook Web Access and certain interaction conditions are met, executing arbitrary JavaScript in the victim's authenticated OWA browser session
Public PoCyes
PoC URLs
https://github.com/atiilla/CVE-2026-42897
https://github.com/PacketPursuit/CVE-2026-42897
https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/EOMT/Mitigations/CVE-2026-42897.ps1 Third-party repos; verify before use.
https://github.com/PacketPursuit/CVE-2026-42897
https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/EOMT/Mitigations/CVE-2026-42897.ps1 Third-party repos; verify before use.
Exploit notesThe vulnerability is a stored XSS in Outlook Web Access with CVSS attack complexity of LOW. The attacker embeds obfuscated JavaScript in email HTML content that renders unsanitized in OWA — no authentication or server access is needed, only the ability to send email to an Exchange user. Microsoft has not disclosed the specific input field or rendering path that bypasses sanitization, nor the exact 'certain interaction conditions' required for script execution. The complexity is further reduced by the availability of the OWA rendering pipeline as a known attack surface (decades of Exchange XSS CVEs). Mitigation (CSP header injection via EOMT/EEMS) has known compatibility issues including broken inline images, OWA Calendar/Print functionality, and OWA Light mode. Internet Explorer clients are completely unprotected. The atiilla/CVE-2026-42897 PoC is a detection-blind-spot tool demonstrating that Exchange Health Checker does not read outbound IIS URL Rewrite rules — it is not a weaponized XSS exploit. The actual weaponized exploit was used by TA488 (Russian APT) with OWAReaper C2 infrastructure (documented by Proofpoint).
SummaryMicrosoft Exchange Server OWA stored XSS spoofing vulnerability (CVE-2026-42897, CVSS 8.1): an unauthenticated attacker sends a crafted email to an Exchange on-premises user; when opened in OWA under certain interaction conditions, arbitrary JavaScript executes in the victim's authenticated session, enabling spoofing, data theft, and session hijacking. Actively exploited as a zero-day.
Tia coverage
First reported2026-05-16
First exploit report2026-05-16
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
microsoft-exchange-server-zero-day-cve-2026-42897-active-owa-spo
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.