Microsoft · Microsoft
CVE-2026-42897
Microsoft Exchange Server Spoofing Vulnerability
What it is
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CISA: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: May 29, 2026
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 18, 2026 | Weak Authentication | SharePoint | Critical 9.1 | 70% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.