Story perspectives

US Exploited Exchange Zero-Day Prompts Urgent Microsoft Mitigation

5/17/2026

Summary

Microsoft Confirms Exploit

Microsoft confirmed the Exchange Server zero-day CVE-2026-42897 is being exploited in the United States.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42897 to its Exploited Vulnerabilities Catalog on May 15.
Microsoft urged customers to enable the Emergency Mitigation Service, use the on-premises tool, and apply the upcoming patch for Exchange 2016, 2019 and Subscription Edition.
Security experts recommended moving to Exchange Online or isolating on-premises servers behind a zero-trust gateway.

Summary

EEMS Deploys

The Emergency Mitigation Service (EEMS) launched in September 2021 after the ProxyLogon and ProxyShell attacks.
Exchange versions released before March 2023 cannot receive new EEMS mitigations and must use the manual tool.
The mitigation may disable OWA Print Calendar, block inline images, and break OWA light mode.
Admins must download the latest tool, run a PowerShell script from an elevated Exchange Management Shell, and confirm EEMS status with the Exchange Health Checker.

Summary

Microsoft Flags Exploit

CVE-2026-42897 lets attackers run malicious JavaScript in Outlook Web Access via a crafted email.
Microsoft disclosed it two days after its May 2026 Patch Tuesday, which fixed 138 flaws.
Many on-premises Exchange servers stay internet-facing, giving threat actors a direct path to networks.
In April, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2023-21529 to its exploit catalog.
SecurityAffairs analyst Pierluigi Paganini reported the CVE-2026-42897 details on social media.

History

Historical Context

In May 2017 the WannaCry ransomware cryptoworm spread via the NSA-leaked EternalBlue SMB exploit, infecting more than 230,000 computers in over 150 countries and crippling the UK’s NHS. The outbreak showed how unpatched Windows systems and delayed patching—issues first highlighted after CryptoLocker’s 2013 rise—continue to enable attacks, a pattern echoed by the 2026 CVE-2026-42897 Exchange Server zero-day now weaponized in the United States.

1 of 4

Microsoft Confirms Exploit

Microsoft confirmed the Exchange Server zero-day CVE-2026-42897 is being exploited in the United States.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42897 to its Exploited Vulnerabilities Catalog on May 15.
Microsoft urged customers to enable the Emergency Mitigation Service, use the on-premises tool, and apply the upcoming patch for Exchange 2016, 2019 and Subscription Edition.
Security experts recommended moving to Exchange Online or isolating on-premises servers behind a zero-trust gateway.

1 / 4