CVE-2026-42897: Microsoft Exchange Server XSS enables spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with known exploitation and a very high EPSS score, though CVSS is only 6.1 and impact is limited to spoofing with user interaction.

What it is

Microsoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (CWE-79). An unauthorized attacker can perform spoofing over the network, and the vendor has published mitigation guidance.

Impact

An attacker can execute script in a victim's browser session in the context of the Exchange web interface, enabling content spoofing and limited confidentiality and integrity impact. No direct code execution or data destruction is described.

Attack surface

Reachable over the network via the Exchange web interface with no authentication required, but the CVSS vector requires user interaction (UI:R), meaning a victim must load or click crafted content. Scope is changed (S:C), so the vulnerable component can affect resources beyond its security authority.

Exploitation

CVE-2026-42897 was added to CISA KEV on 2026-05-15 with a 2026-05-29 remediation due date, indicating known exploitation in the wild. EPSS is 0.71205 (99.4th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2026-42897.
• If patching cannot be completed by the KEV due date, apply the vendor mitigations or discontinue use of the affected product per BOD 22-01 guidance.
• Enforce output encoding and input validation on Exchange web-facing components as a defense-in-depth control.
• Restrict or monitor external access to Exchange web interfaces (OWA, ECP) to reduce exposure to crafted requests.

Detection

• Review Exchange web server and IIS logs for requests containing script payloads or unusual encoded characters in URL and form parameters.
• Monitor for anomalous or unexpected script content in Exchange web responses served to clients.
• Hunt for user reports or proxy logs showing redirects or injected content on Exchange web pages.
• Correlate Exchange web access logs with KEV-driven patch tracking to confirm remediation status across servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.