CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-05-15
EPSS: 70.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-10-26
Weakness: CWE-79

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Summary

CVE-2026-42897 is a cross-site scripting (XSS) flaw in Microsoft Exchange Server caused by improper neutralization of input during web page generation, allowing an unauthenticated attacker to perform spoofing over the network. It carries a medium CVSS score of 6.1 but is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 70.7% probability of exploitation in the next 30 days. Affected products are Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition, with the latter fixed in 15.02.2562.043. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-42897 ثغرة Cross-Site Scripting (XSS) في Microsoft Exchange Server ناتجة عن عدم تحييد المدخلات بشكل صحيح أثناء إنشاء صفحات الويب، ما يتيح لمهاجم غير مصرح له تنفيذ انتحال عبر الشبكة. درجة CVSS متوسطة (6.1)، لكن الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 70.7%. المنتجات المتأثرة هي Microsoft Exchange Server وMicrosoft Exchange Server Subscription Edition، وقد تم إصلاح الأخير في الإصدار 15.02.2562.043. طبّق التخفيفات وفق تعليمات المورّد، واتبع إرشادات BOD 22-01 ذات الصلة للخدمات السحابية، أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

Microsoft Exchange Server: 2016-cumulative_update_1, 2016-cumulative_update_10, 2016-cumulative_update_11, 2016-cumulative_update_12, 2016-cumulative_update_13, 2016-cumulative_update_14 (+31); 2016, 2019
Microsoft Exchange Server Subscription Edition: before 15.02.2562.043 — fixed in 15.02.2562.043
Microsoft Exchange Server 2016 Cumulative Update 23: from 15.01.0.0 before 15.01.2507.069 — fixed in 15.01.2507.069
Microsoft Exchange Server 2019 Cumulative Update 14: from 15.02.0.0 before 15.02.1544.041 — fixed in 15.02.1544.041
Microsoft Exchange Server 2019 Cumulative Update 15: from 15.02.0.0 before 15.02.1748.046 — fixed in 15.02.1748.046
Microsoft Exchange Server Subscription Edition RTM: from 15.02.0.0 before 15.02.2562.043 — fixed in 15.02.2562.043

How to fix

Upgrade to a fixed version: Microsoft Exchange Server Subscription Edition 15.02.2562.043; Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.069; Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.041; Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.046; Microsoft Exchange Server Subscription Edition RTM 15.02.2562.043. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42897 or the next vulnerability affects your stack