Microsoft Exchange Server users are urged to immediately mitigate a newly disclosed zero-day vulnerability that has been exploited in attacks.
Microsoft this week patched 137 vulnerabilities with its Patch Tuesday updates and the cybersecurity industry was surprised to see that the latest updates did not address any zero-days. However, a zero-day was disclosed just 48 hours later, on May 14.
The Exchange zero-day, tracked as CVE-2026-42897, has been described as a spoofing and XSS issue affecting Exchange Server Subscription Edition, 2016, and 2019.
“Improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network,” Microsoft said in its advisory.
The company noted that the vulnerability affects Exchange Outlook Web Access (OWA) and an attacker can exploit it by sending a specially crafted email to the targeted user.
“If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context,” Microsoft explained.
Until a permanent patch is developed, Microsoft has shared a couple of mitigation options.
Microsoft has not shared any information on the attacks exploiting CVE-2026-42897. SecurityWeek has reached out to the company for clarification and will update this article if it responds.
An anonymous researcher has been credited for reporting the vulnerability.
It’s not uncommon for threat actors to target Exchange Server vulnerabilities — CISA’s KEV catalog currently lists nearly two dozen such flaws — but there do not appear to be any other reports of vulnerabilities discovered in 2025 and 2026 being exploited in the wild.
It’s worth noting that CVE-2026-42897 has yet to be added to CISA’s KEV list.
UPDATE: Microsoft has provided the following statement to SecurityWeek:
“We have issued CVE-2026-42897 to address a spoofing vulnerability affecting Exchange Outlook Web Access (OWA). We recommend customers enable EEMS to be better protected and to follow our guidance available here.”
Related: Microsoft Patches Critical Zero-Click Outlook Vulnerability Threatening Enterprises
Related: Cisco Patches Another SD-WAN Zero-Day, the Sixth Exploited in 2026
Related: Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks
Related: Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking
