Microsoft Confirms Exchange Server Zero-Day Under Active Exploitation

Microsoft disclosed CVE-2026-42897 on May 14, describing the issue as a spoofing vulnerability in Microsoft Exchange Server. The flaw allows an attacker to send a maliciously crafted email that executes arbitrary JavaScript when opened in Outlook Web Access.

U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities Catalog on May 15. CISA urged organizations to prioritize remediation because the attack vector poses a significant risk.

Online is not impacted.

The following on-premises versions are affected: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition, all at any update level. Microsoft has recommended mitigation through the Exchange Emergency Mitigation Service. The company stated that using the service is the best way to address the vulnerability immediately.

x has been applied. Microsoft confirmed the HTML report will include a section on EEMS check results. , said the disclosure is a reminder that on-premises Exchange remains the most targeted piece of real estate in the enterprise stack. Jacob Krell, senior director of secure AI solutions and Cybersecurity at Suzu Labs, said Exchange remains one of the most dangerous places for a remote code execution flaw to land.