Microsoft Confirms Active Exploitation of Unpatched Exchange Server CVE-2026-42897 as CISA Adds It to KEV With May 29 Deadline

Overview

Microsoft has confirmed that attackers are actively exploiting a cross-site scripting flaw in on-premises Microsoft Exchange Server, tracked as CVE-2026-42897, and has published mitigation guidance ahead of a permanent patch. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog on May 15, 2026, giving federal civilian executive branch agencies until May 29 to apply vendor mitigations under Binding Operational Directive 22-01. Exchange Online is not affected.

The vulnerability sits in the Outlook Web Access component of Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. According to the advisory page indexed by NVD, the underlying weakness is CWE-79 — improper neutralization of input during web page generation — and Microsoft as the CVE Numbering Authority has assigned a CVSS v3.1 base score of 8.1, in the HIGH severity band. NIST analysts have published a separate base score of 6.1 (MEDIUM) using the same attack vector. The discrepancy reflects how the two scorers model scope and impact for an OWA-based spoofing chain.

What We Know

Microsoft’s advisory describes the attack mechanism plainly. “An attacker could exploit this issue by sending a specially crafted email to a user,” the company wrote, and “if the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context,” according to a quote reproduced by BleepingComputer and Help Net Security. Microsoft has not disclosed which interaction conditions are required, Help Net Security notes, leaving defenders without the granular indicators that often accompany Exchange advisories.

The CISA KEV entry, retrieved from the catalog’s published JSON feed, names the bug “Microsoft Exchange Server Cross-Site Scripting Vulnerability” and gives a single-paragraph description: the flaw allows execution of arbitrary JavaScript in the browser context when a user opens a crafted message in Outlook Web Access and certain interaction conditions are met, per the CISA KEV catalog. The required action listed for federal agencies is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The ransomware-campaign field is marked Unknown.

The vulnerability was reported to Microsoft by an anonymous researcher, according to The Hacker News, Help Net Security, and SecurityWeek. No threat actor has been publicly named, and Cybersecurity News noted that Microsoft has not publicly linked the vulnerability to any ransomware campaign.

Mitigation, Not Yet a Patch

Microsoft has not released a permanent security update. Instead, the Exchange Team’s guidance directs administrators to two existing emergency-response paths.

The first is the Exchange Emergency Mitigation Service. EEMS, which Microsoft ships enabled by default on Exchange 2016, 2019, and Subscription Edition, automatically applies the relevant mitigation when activated. Help Net Security reports that, with the service enabled, “the mitigation is implemented automatically.” Infosecurity Magazine adds that the service applies a mitigation identified internally as M2.1.x and that administrators can confirm its status using the Exchange Health Checker script.

For air-gapped servers and environments where EEMS is disabled, BleepingComputer reports that Microsoft is also pointing administrators to the Exchange On-premises Mitigation Tool, with the published command shown as .\EOMT.ps1 -CVE "CVE-2026-42897". The Hacker News lists the canonical download location at aka.ms/UnifiedEOMT.

Both mitigation routes carry user-visible side effects. Infosecurity Magazine reports that the mitigation “can cause issues, such as disabling or disrupting features (e.g. OWA Print Calendar, Inline images).” Administrators weighing automated rollout against feature regressions are therefore caught in the same trade-off that has accompanied previous Exchange emergency mitigations.

Microsoft has told customers, as quoted by Help Net Security, that it “is working on and will release and announce a security update for impacted versions of Exchange Server in the future,” without committing to a date. BleepingComputer notes the planned patches will target Exchange Server Subscription Edition RTM, Exchange Server 2016 CU23, and Exchange Server 2019 CU14 and CU15, with updates for the 2016 and 2019 lines limited to customers enrolled in the Period 2 Exchange Server Extended Security Updates program.

What We Don’t Know

Microsoft has not described the “certain interaction conditions” that must be present for the script to execute, and none of the cited outlets identify the threat actor or campaign behind the in-the-wild exploitation. The CISA KEV entry leaves the ransomware-use field as Unknown, and as of publication no public indicator-of-compromise feed has been associated with the campaign. The shape of the exploit chain beyond the initial OWA payload — whether attackers are pivoting to credential theft, mailbox rule manipulation, or further server-side abuse — has also not been detailed publicly.

The split CVSS scores hint at unresolved analytic disagreement. Microsoft’s CNA vector treats the scope as unchanged but confidentiality and integrity impact as high, producing 8.1, while the NIST analysts model the scope as changed but with low impact on each dimension, producing 6.1, according to the NVD detail page. Either way, both scores assume successful user interaction with a malicious OWA-rendered message — a precondition that has not slowed prior exploitation of Exchange flaws.

Context

CVE-2026-42897 lands amid a steady cadence of Exchange and edge-device advisories the federal government has marked as actively exploited. CISA most recently added another high-profile network-edge bug — Cisco Catalyst SD-WAN’s CVE-2026-20182 — to the same KEV catalog earlier in May, as previously reported. Both additions sit inside the BOD 22-01 enforcement frame, and both arrived without a fully released permanent fix at the moment of disclosure. For administrators of on-premises Exchange — a population that has been told repeatedly to migrate to Exchange Online and which is now down to the Subscription Edition and the ESU-fenced 2016/2019 lines for any path forward — the latest advisory closes another two-week window in which the only available response is to turn on a Microsoft-managed mitigation, accept the feature regressions, and wait for the patch.