Microsoft Exchange Server Zero-Day (CVE-2026-42897) Actively Exploited: Risks, Mitigations, and Outlook

On May 14 2026 Microsoft disclosed CVE-2026-42897, a critical cross-site-scripting (XSS) flaw in on-premises Exchange Server 2016, 2019 and Subscription Edition (SE). The vulnerability allows an unauthenticated attacker to send a specially crafted email that, when opened in Outlook Web Access (OWA), executes arbitrary JavaScript in the browser context, enabling network-level spoofing and remote code execution. The advisory assigns a CVSS score of 8.1, classifying the issue as high-severity. Exchange Online is not affected.

CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-dayMicrosoft Warns of Exchange Server Zero-Day Flaw Actively Exploited in AttacksForbesMicrosoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

Microsoft’s interim protection is the Exchange Emergency Mitigation Service (EEMS), enabled by default on supported on-premises servers. When active, EEMS applies URL-rewrite rules that block the malicious payload. Administrators can verify the service via the Exchange Health Checker script or by confirming the applied mitigation identifier (M2.1.x). For air-gapped or disconnected environments, Microsoft provides the Exchange On-premises Mitigation Tool (EOMT), which runs a PowerShell script targeting the CVE-2026-42897 identifier. Both mitigations may disable OWA Print Calendar, inline images, and the deprecated OWA light mode.

Microsoft Warns of Exchange Server Zero-Day Flaw Actively Exploited in AttacksMicrosoft Reports Severe Zero-Day Flaw in On-Prem Exchange ServersMicrosoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It WorseForbes

Microsoft’s security advisory urges immediate deployment of EEMS and recommends enabling the service if it is disabled. The company also announced that permanent patches will be released for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14/15, with the latter two limited to customers enrolled in the Period 2 Extended Security Update (ESU) program. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed CVE-2026-42897 in its Known Exploited Vulnerabilities (KEV) catalog on May 15, advising organizations to prioritize remediation.

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

Damon Small, director of Xcape Inc., warned that the flaw underscores the persistent targeting of on-premises Exchange and that “this zero-day allows unauthenticated remote code execution, effectively granting attackers a direct path to the heart of corporate identity and communications.” He further urged organizations to accelerate migration to Exchange Online or, at minimum, isolate on-premises servers behind a zero-trust gateway. Small also highlighted that a single misconfigured server can become a beachhead for full-domain compromise.

Forbes

• CVSS 8.1 (high severity)

Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers

• Affected products: Exchange Server 2016, 2019, and Subscription Edition (any update level)

Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers

• Reported active exploitation within 48 hours of disclosure

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

• Microsoft’s May 2026 Patch Tuesday addressed either 137 or 138 separate vulnerabilities (sources differ).

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

• CISA catalog status: One source states CVE-2026-42897 was added to the KEV catalog on May 15; another notes it had not yet been listed at the time of reporting.

CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-day

• Patch Tuesday count: Sources report both 137 and 138 vulnerabilities fixed, creating uncertainty about the exact scope of the prior update cycle.

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

• Exploitation details: Microsoft confirmed active exploitation but provided no information on threat actors, target sectors, or attack outcomes.

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse

• “The disclosure of CVE-2026-42897 is a reminder that on-premises Exchange remains the most targeted piece of real estate in the enterprise stack,” — Damon Small, Director, Xcape Inc.

Forbes

• “this zero-day allows unauthenticated remote code execution, effectively granting attackers a direct path to the heart of corporate identity and communications.” — Damon Small, Director, Xcape Inc.

Forbes

• “Improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.” — Microsoft advisory

CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-day

• “Using EM Service is the best way for your organization to mitigate this vulnerability right away,” — Microsoft statement

Forbes

• “at the very least, to isolate these servers behind a zero-trust gateway.” — Damon Small, Director, Xcape Inc.

Forbes

Microsoft plans to release permanent updates for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14/15 in the coming weeks. Organizations not enrolled in the Period 2 ESU program will need to consider migration to Exchange Online or implement zero-trust network segmentation to reduce exposure while awaiting patches.

Microsoft Exchange Zero-Day Exploited in the Wild — and Pwn2Own Researchers Just Made It Worse