Microsoft Exchange Server Cross-Site Scripting Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · Catalog

   Detected

   Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

2. May 15, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. May 29, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

5. Jun 17, 2026 · NIST NVD

   Updated

   Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Affected

• cpe microsoft/exchange server2016
• vendor Microsoft Microsoftversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2026-42897

  Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-42897

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-42897

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2026-42897

  Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  nvd.nist.gov

References

• CISA note · learn.microsoft.com
• CISA note · msrc.microsoft.com
• Mitigation · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov