All vulnerabilities
CVE-2026-42897

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Microsoft
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationExploited in the wildAdded to KEV 15 May 2026CISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.01.2507.069Also 15.02.1544.041, 15.02.1748.046 and 1 moreCVE List
Federal deadline29 May 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 15.01.2507.069Microsoft Exchange Server 2016 Cumulative Update 23CVE List
  • 15.02.1544.041Microsoft Exchange Server 2019 Cumulative Update 14CVE List
  • 15.02.1748.046Microsoft Exchange Server 2019 Cumulative Update 15CVE List
  • 15.02.2562.043Microsoft Exchange Server Subscription Edition RTMCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 14 May 2026, 17:00 UTCPublishedCVE List
  2. 15 May 2026Added to CISA KEVCISA KEV

Description

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Text from CVE List

Affected versions 4

  • Microsoft Exchange Server 2016 Cumulative Update 23affected: 15.01.0.0 before 15.01.2507.069CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 14affected: 15.02.0.0 before 15.02.1544.041CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 15affected: 15.02.0.0 before 15.02.1748.046CVE List
  • Microsoft Exchange Server Subscription Edition RTMaffected: 15.02.0.0 before 15.02.2562.043CVE List

References 5