CVE-2026-42897
Description
CVE-2026-42897 is a high-severity XSS vulnerability in Microsoft Exchange Server (CVSS 8.1) that allows spoofing and is actively exploited in the wild.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2016 | 2016 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server | 2019 | 2019 | vulnerable |
| exchange_server_subscription_edition | * | 15.02.2562.043 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest Security Updates (SU) provided by Microsoft for Exchange Server 2016, 2019, and Subscription Edition. Refer to the Microsoft Security Response Center (MSRC) for specific KB articles and installation instructions tailored to your environment.
Update affected systems
Ensure all Exchange Server instances are updated to non-vulnerable versions. Specifically, Exchange Server Subscription Edition must be updated to version 15.02.2562.043 or later. Verify that all Cumulative Updates (CU) are current before applying the necessary security patches.
Restrict access
Minimize the attack surface by restricting access to Exchange management interfaces and Outlook Web Access (OWA) to trusted IP addresses via firewalls or VPNs. Implement robust email filtering to block malicious links and scripts that could trigger the XSS payload.
Monitor for exploitation
Enable and review Exchange audit logs and IIS logs for unusual patterns, such as unexpected script execution in web sessions or suspicious redirects. Utilize the Exchange Emergency Mitigation Service (EEMS) to automatically apply temporary protections as they are released by Microsoft.
Detection Guidance
"To detect potential exploitation of CVE-2026-42897, monitor IIS logs for suspicious URL parameters or script injections targeting Exchange web components like OWA. Look for unusual network traffic patterns indicating spoofing attempts or unauthorized redirects. Implement WAF signatures that identify common XSS patterns. Additionally, use Microsoft's Exchange Server Health Checker script to identify missing security updates and ensure the Exchange Emergency Mitigation Service is active and functioning correctly."