Microsoft has issued a warning about a high-severity zero-day vulnerability (CVE-2026-42897) affecting on-premises installations of Microsoft Exchange Server. The vulnerability allows attackers to execute arbitrary code via cross-site scripting (XSS) targeting users of Outlook on the web.
What Happened
According to Microsoft, the vulnerability impacts Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). Attackers can exploit this flaw by sending a specially crafted email to a user; if the user opens it in Outlook Web Access and certain conditions are met, the attacker can execute JavaScript in the user’s browser context.
While a full patch isn't immediately available, Microsoft is offering mitigations. The primary recommended approach is to enable the Exchange Emergency Mitigation Service (EEMS), which provides automatic protection. EEMS was originally introduced to address rapid response to vulnerabilities like ProxyLogon and ProxyShell. Administrators with servers in air-gapped environments can use the Exchange On-premises Mitigation Tool (EOMT) to apply the mitigation manually via PowerShell. The commands to apply the mitigation are:
powershell .\EOMT.ps1 -CVE "CVE-2026-42897" # Single server Get-ExchangeServer | Where-Object { $_.ServerRole -ne "Edge" } | .\EOMT.ps1 -CVE "CVE-2026-42897" # All servers
However, applying these mitigations introduces some functionality limitations, including issues with OWA Print Calendar, inline image display, and OWA light.
Why It Matters
This vulnerability is particularly concerning because it's actively being exploited. The availability of mitigations is a positive step, but they aren’t a complete fix. The reliance on EEMS is noteworthy, demonstrating Microsoft’s strategy of providing rapid, automated protection for critical on-premises infrastructure. The fact that full patches for Exchange 2016 and 2019 are limited to customers with an active Exchange Server Extended Security Update (ESU) agreement highlights the importance of maintaining support contracts or planning upgrades for end-of-life software.
The vulnerability underscores the ongoing risk of attacks targeting Exchange Server. Over the past five years, CISA has added 19 Exchange vulnerabilities to its list of actively exploited flaws, with a significant number linked to ransomware attacks. This highlights the need for robust security practices and proactive vulnerability management.
What To Watch
Microsoft plans to release patches for Exchange SE RTM, Exchange 2016 CU23, and Exchange Server 2019 CU14 and CU15. However, the timing and availability of those patches, especially for older versions of Exchange, are dependent on ESU subscription status. Organizations should closely monitor Microsoft’s security updates and prioritize patching when available. It remains uncertain how widespread the exploitation of this vulnerability is, and further analysis of attack campaigns is needed. Administrators should also review CISA and NSA guidance on hardening Exchange servers.