Story perspectives

Microsoft Rolls Out Fix for Outlook Web Access XSS Flaw

5/19/2026

Summary

Microsoft Deploys Mitigation

Microsoft deployed mitigation (M2) for the exploited CVE-2026-42897 reflected XSS flaw in Outlook Web Access.
The reflected XSS bug lets an unauthenticated attacker run JavaScript in an Outlook Web Access session via a crafted email.
Exploitation can capture session tokens, spoof identities, and grant access, but it does not affect service availability.
Admins must activate mitigation M2, apply it with the On-premises Tool when EEMS is off and boost monitoring.

Summary

CISA Flags Zero-Day

Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42897 to its Exploited Vulnerabilities Catalog on May 15, first Exchange Server flaw listed as actively exploited.
CISA issued an advisory urging organizations to remediate the zero-day.
Microsoft confirmed vulnerability on May 14 and coordinated disclosure with CISA’s warning.
The alert cited a Windows 11 proof-of-concept exploit that grants privileges on patched systems.
Damon Small, director of Xcape, Inc., said on-premises Exchange remains the most targeted asset.

Summary

Microsoft Patches Flaws

Microsoft patched over 130 flaws in a week using its AI bug-hunting system MDASH.
Jacob Krell of Suzu Labs warned that Exchange’s link to identity makes it a fast-moving exploit target.
Damon Small of Xcape, Inc. advised moving to Exchange Online or isolating on-prem servers behind a zero-trust gateway.
Servers older than March 2023 cannot receive EEMS updates, prompting experts to push cloud-first mail strategies.

1 of 3

Microsoft Deploys Mitigation

Microsoft deployed mitigation (M2) for the exploited CVE-2026-42897 reflected XSS flaw in Outlook Web Access.
The reflected XSS bug lets an unauthenticated attacker run JavaScript in an Outlook Web Access session via a crafted email.
Exploitation can capture session tokens, spoof identities, and grant access, but it does not affect service availability.
Admins must activate mitigation M2, apply it with the On-premises Tool when EEMS is off and boost monitoring.

1 / 3