CVE-2026-42897

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · Catalog

   Detected

   Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

2. May 15, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. May 29, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Affected

• cpe microsoft/exchange server2016
• vendor Microsoft Microsoftversion unspecified

Sources

• CISA KEVCVE-2026-42897

  Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

  cisa.gov
• CVE.orgCVE-2026-42897

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2026-42897

  30-day exploitation probability 0.5%

  first.org
• NIST NVDCVE-2026-42897

  Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  nvd.nist.gov

References

• CISA note · learn.microsoft.com
• CISA note · msrc.microsoft.com
• Mitigation · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov