Microsoft Confirms Active Exploitation of Exchange Server Zero-Day CVE-2026-42897, CISA Sets May 29 Federal Remediation Deadline

Microsoft on May 14 disclosed CVE-2026-42897, a critical spoofing vulnerability in on-premises Exchange Server now under active exploitation. The flaw, rated 8.1 on the CVSS scale, lets an unauthenticated attacker execute arbitrary JavaScript in a victim's browser by sending a specially crafted email that triggers a cross-site scripting flaw in Outlook Web Access.

Exchange Server 2016, 2019 and Subscription Edition are all vulnerable; Exchange Online is unaffected. CISA added the bug to its Known Exploited Vulnerabilities catalog on May 15, ordering federal agencies to remediate by May 29. Microsoft is shipping temporary protection through the Exchange Emergency Mitigation Service while a permanent patch is finalized.

The vulnerability was reported anonymously and was being exploited in the wild before disclosure, marking the second on-prem Exchange zero-day attackers have weaponized via the OWA browser surface in two years.