CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

CVE ID

CVE-2026-42897

Vulnerability Name

Microsoft Exchange Server Cross-Site Scripting Vulnerability

• Project: Microsoft
• Product: Microsoft

Date

• Date Added: 2026-05-15
• Due Date: 2026-05-29

Description

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List