Microsoft Exchange Server Zero-Day (CVE-2026-42897) Actively Exploited; Emergency Mitigation Urged

On May 14, 2026 Microsoft confirmed a critical vulnerability in on-premises Microsoft Exchange Server, designated CVE-2026-42897. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities Catalog on May 15, stating that attackers are already exploiting the flaw in the wild. The vulnerability enables unauthenticated remote code execution through a crafted email opened in Outlook Web Access (OWA).

ForbesWARNING: Cross-Site Scripting in Microsoft Exchange Server Can Be Exploited to Perform Spoofing and Session Hijacking. Actively Exploited in the Wild, Apply Mitigations Immediately!Tom's Guide

CVE-2026-42897 is a reflected cross-site scripting (XSS) flaw (CWE-79) in the OWA component. An attacker sends a specially crafted email; when the recipient opens it in OWA, arbitrary JavaScript runs in the authenticated browser session, allowing session token capture, mailbox access, and modification of email content or settings. The vulnerability does not affect Exchange Online. Affected on-premises products include Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (any update level).

Tom's GuideWARNING: Cross-Site Scripting in Microsoft Exchange Server Can Be Exploited to Perform Spoofing and Session Hijacking. Actively Exploited in the Wild, Apply Mitigations Immediately!Forbes

Microsoft has released an Emergency Mitigation Service (EEMS) update identified as mitigation M2.1.x (also referenced as M2). Organizations are instructed to enable EEMS immediately, run the Exchange Health Checker script, and verify that the mitigation appears in the generated HTML report. The Exchange Team notes that EEMS will not function on versions older than March 2023. CISA’s advisory urges rapid deployment of the mitigation and continuous monitoring. The Centre for Cybersecurity Belgium (CCB) likewise recommends applying Microsoft’s mitigations without delay and enhancing detection capabilities for related activity.

Forbes

Security analysts emphasize the urgency of the situation. Damon Small, director of Xcape, Inc., warns that the lack of a formal patch forces a “mitigation-only posture,” likening the emergency service to a “virtual band-aid to a critical wound.” Jacob Krell, senior director of secure AI solutions at Suzu Labs, describes Exchange as “one of the most dangerous places for a remote code execution flaw to land” because it sits close to identity and core communication layers. Both analysts call for accelerated migration to Exchange Online or isolation behind zero-trust gateways.

Forbes

The flaw provides a direct path to corporate identity stores and communications, raising the risk of credential theft, unauthorized mailbox access, and potential domain compromise. Because a single misconfigured server can serve as a foothold for broader intrusion, the vulnerability threatens the confidentiality and integrity of enterprise email traffic.

WARNING: Cross-Site Scripting in Microsoft Exchange Server Can Be Exploited to Perform Spoofing and Session Hijacking. Actively Exploited in the Wild, Apply Mitigations Immediately!

No public security update is available as of May 18, 2026; mitigation remains the sole protective measure. Sources do not disclose the number of successful exploitations or specific threat actors, leaving the scale of compromise uncertain.

Forbes

• “The disclosure of CVE-2026-42897 is a reminder that on-premises Exchange remains the most targeted piece of real estate in the enterprise stack,” — Damon Small, Director, Xcape, Inc.

Forbes

• “Using EM Service is the best way for your organization to mitigate this vulnerability right away.” — Microsoft (Exchange Team)

Tom's Guide

• “sits close to identity and inside the communication layer most organizations depend on every day.” — Jacob Krell, Senior Director, Suzu Labs

Forbes

• “An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context,” — Microsoft Exchange Team

Tom's Guide

Microsoft plans to release a permanent patch in a future update cycle. In the interim, organizations should verify EEMS activation, apply the mitigation across all affected servers, and monitor for anomalous OWA activity. The CCB advises reporting any suspected intrusion through its incident-reporting portal. Continuous vigilance remains essential until a full remediation is available.

Forbes