{"id":931,"date":"2026-05-15T07:01:15","date_gmt":"2026-05-15T07:01:15","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=931"},"modified":"2026-05-15T07:01:15","modified_gmt":"2026-05-15T07:01:15","slug":"on-prem-microsoft-exchange-server-cve-2026-42897-exploited-via-crafted-email","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=931","title":{"rendered":"On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">May 15, 2026<\/span><\/span><span class=\"p-tags\">Microsoft \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEirN79ZRjEd5wnVbOTlJJsWjQ54cwSj2bM5NDzBSgAFO8f_9LrlIwQRI0ZogQX42iejmhgc1n2YcA91pFrVqtqNKKyAIXblcQ1Yx9LTs1TeNDbNN6JMUBXCKDK1W0IwnwvYl1dhQmcyTPHwakckKT_Kc9fAUDAJRj94g2pENrjy4UyTCCniOXI2rO-q66PC\/s1700-e365\/Microsoft-Exchange.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.<\/p>\n<p>The vulnerability, tracked as <strong>CVE-2026-42897<\/strong> (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue.<\/p>\n<p>\u00abImproper neutralization of input during web page generation (&#8216;cross-site scripting&#8217;) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network,\u00bb the tech giant <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-42897\">said<\/a> in a Thursday advisory.<\/p>\n<p>Microsoft, which tagged the vulnerability with an \u00abExploitation Detected\u00bb assessment, said an attacker could weaponize it by sending a crafted email to a user, which, when opened in Outlook Web Access and subject to other \u00abcertain interaction conditions,\u00bb can allow arbitrary JavaScript code to be executed in the context of the web browser.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlabz-vpn-risk-2026-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhnNON5UeWywT7OcPNw7V4L7QNWnCnm7Xl_99Y9ek8dL-gRwx-bWxQM1TKqt8deqqrdpUyKMuuijAWyyPQVB0s0qf8ntQ6ldFAJLru-QUWhddKTopc7SeNbBBnd-TsfFyRPP-AAyDuclLlL6XHK4_LXqDC_7eyaz9pzToYr7U543MhrJ7qcK-89sVWHTQUZ\/s728-e100\/zz-2-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Redmond also noted that it&#8217;s providing a temporary mitigation through its <a href=\"https:\/\/learn.microsoft.com\/en-us\/exchange\/plan-and-deploy\/post-installation-tasks\/security-best-practices\/exchange-emergency-mitigation-service\">Exchange Emergency Mitigation Service<\/a>, while it&#8217;s readying a permanent fix for the security defect.<\/p>\n<p>The Exchange Emergency Mitigation Service will provide the mitigation automatically via a URL rewrite configuration, and is enabled by default. It&#8217;s not on, users are advised to enable the Windows service.<\/p>\n<p>According to Microsoft, Exchange Online is not impacted by this vulnerability. The following on-premises Exchange Server versions are affected &#8211;<\/p>\n<ul>\n<li>Exchange Server 2016 (any update level)<\/li>\n<li>Exchange Server 2019 (any update level)<\/li>\n<li>Exchange Server Subscription Edition (SE) (any update level)<\/li>\n<\/ul>\n<p>If using the Exchange Emergency Mitigation Service is not an option due to air-gap restrictions, the company has outlined the following series of actions &#8211;<\/p>\n<ul>\n<li>Download the latest version of the Exchange on-premises Mitigation Tool (EOMT) from aka[.]ms\/UnifiedEOMT.<\/li>\n<li>Apply the mitigation on a per-server basis or on all servers at once by running the script via an elevated Exchange Management Shell (EMS):\n<ul>\n<li>Single server: .\\EOMT.ps1 -CVE \u00abCVE-2026-42897\u00bb<\/li>\n<li>All servers: Get-ExchangeServer | Where-Object { $_.ServerRole -ne \u00abEdge\u00bb } | .\\EOMT.ps1 -CVE \u00abCVE-2026-42897\u00bb<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-cant-stop-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjPEV6-530TOlxG6PjrmdlY623wpBwduZ7t1HV6flcmO5R4q4AmfixDUzW0CrhlvMVNWbhvOIso-UDNTka4W_W9Chrdj_dglwBZwi7DuePM2IMIl-hfUYVIqBXgfpr_2619K8Gptb4LzwJ6gUbi7lWl2M8AFQJsHEaw63Q7tZ6708YGruiHrr0Y2W9YYxLQ\/s728-e100\/ThreatLocker-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Microsoft said it&#8217;s also aware of a known issue where mitigation shows the \u00abMitigation invalid for this exchange version\u00bb in the Description field. \u00abThis issue is cosmetic and the mitigation DOES apply successfully if the status is shown as &#8216;Applied,'\u00bb the Exchange Team <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/exchange\/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897\/4518498\">said<\/a>. \u00abWe are investigating on how to address this.\u00bb<\/p>\n<p>There are currently no details on how the vulnerability is being exploited, the identity of the threat actor behind the activity, or the scale of such efforts. It&#8217;s also unclear who the targets are and if any of those attacks were successful. In the interim, it&#8217;s recommended to apply the mitigations recommended by Microsoft.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802May 15, 2026Microsoft \/ Vulnerability Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.&hellip;<\/p>\n","protected":false},"author":1,"featured_media":932,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1684,1683,954,1290,128,147,1682,518],"class_list":["post-931","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-crafted","tag-cve202642897","tag-email","tag-exchange","tag-exploited","tag-microsoft","tag-onprem","tag-server"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=931"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/931\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/932"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}