CVE-2026-42897

High8.1Published on May 14, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since May 15, 2026
US federal agencies must remediate it by May 29, 2026 (BOD 22-01)
Attacked 1 day before the vulnerability was made public

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Sep 11, 2026 Aug 7, 2026 Jul 28, 2026 Jul 7, 2026 May 27, 2026 May 15, 2026

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness type (CWE)CWE-79

Vendorsmicrosoft

Affected products

Vendors	Product	Versions
microsoft	exchange server	2016
microsoft	exchange server subscription edition	< 15.02.2562.043

APT

Laundry Bear exploits Exchange OWA zero-day: persistent and invisible espionage

Laundry Bear APT exploits an Exchange OWA zero-day (CVE-2026-42897) deploying the OWAReaper backdoor for invisible espionage and persistent mailbox access.

Jul 30, 202603:103 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Laundry Bear exploits Exchange OWA zero-day: persistent and invisible espionage