CVE-2026-42897
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since May 15, 2026
- US federal agencies must remediate it by May 29, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Oct 29, 2026 Sep 11, 2026 Aug 7, 2026 Jul 28, 2026 Jul 7, 2026 May 27, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NAffected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | exchange server | 2016 |
| microsoft | exchange server subscription edition | < 15.02.2562.043 |
Related articles
NightEagle, Hacking Cat, and Toy Ghouls Target Russian Networks
Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian firms with Exchange exploits, backdoors, ransomware and wipers.
Laundry Bear exploits Exchange OWA zero-day: persistent and invisible espionage
Laundry Bear APT exploits an Exchange OWA zero-day (CVE-2026-42897) deploying the OWAReaper backdoor for invisible espionage and persistent mailbox access.
This product uses the NVD API but is not endorsed or certified by the NVD.