Microsoft Exchange CVE-2026-42897 Exploited via Crafted Email: Patch Now

Microsoft has confirmed that a newly disclosed vulnerability affecting on-premise versions of Exchange Server is being actively exploited in the wild. The attack vector is one that every enterprise security team should treat as an immediate operational risk: a crafted email. The vulnerability, tracked as CVE-2026-42897 and carrying a CVSS score of 8.1, is a cross-site scripting flaw classified as improper neutralisation of input during web page generation. Microsoft tagged it with an "Exploitation Detected" classification upon releasing its advisory on 15 May 2026. The discovery was reported by an anonymous security researcher.

How the attack works

An unauthenticated attacker can exploit CVE-2026-42897 by sending a malicious email to a target user. If the recipient opens the message through Outlook Web Access (OWA) and specific interaction conditions are met, arbitrary JavaScript code executes within the context of their web browser session. This gives the attacker the ability to perform spoofing actions, steal session tokens, or pivot further into the organisation's environment depending on the privilege level of the affected user. Microsoft described the mechanism plainly in its advisory:

"Improper neutralisation of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorised attacker to perform spoofing over a network."

The combination of email delivery as the trigger and browser-based JavaScript execution as the outcome makes the attack surface broad. The user interaction requirement is low, and in enterprise environments where OWA is the standard remote access method for email, the exposure is wide.

Who is at risk

The flaw affects three generations of on-premise Exchange Server: Exchange Server 2016 at any update level, Exchange Server 2019 at any update level, and Exchange Server Subscription Edition at any update level. Exchange Online is confirmed as not impacted. For organisations across the GCC and MENA region running on-premise Exchange deployments, a configuration that remains prevalent in regulated industries including banking, government, and healthcare, this vulnerability applies directly. It sits in the same urgent patch category as the Cisco SD-WAN CVSS 10.0 authentication bypass that CISA added to its KEV list earlier this month. Both flaws are actively exploited, both affect enterprise infrastructure common in the Gulf, and both carry a federal remediation mandate. As identity and access management has become the defining challenge for GCC enterprise security, a browser-based session hijacking vector via email represents exactly the kind of credential exposure that threat actors are optimising for in 2026.

Mitigation and remediation steps

Microsoft has deployed a temporary mitigation through its Exchange Emergency Mitigation Service (EEMS), which applies a URL rewrite configuration automatically and is enabled by default. Organisations should verify EEMS is active across all Exchange servers as a first action. For environments where EEMS cannot be used, such as air-gapped deployments common in government and critical infrastructure settings across the Gulf, Microsoft has published a manual remediation path using the Exchange on-premises Mitigation Tool (EOMT). The command for applying the fix across all non-Edge Exchange servers via an elevated Exchange Management Shell is:

Get-ExchangeServer | Where-Object { $_.ServerRole -ne "Edge" } | .\EOMT.ps1 -CVE "CVE-2026-42897"

Microsoft has noted a known display issue where the mitigation may show "Mitigation invalid for this Exchange version" in the description field. The Exchange Team has confirmed this is cosmetic only: if the status reads "Applied", the mitigation has been successfully deployed. A permanent fix is in development and expected to follow via a future security update.

CISA mandate and what it signals

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-42897 to its Known Exploited Vulnerabilities catalogue on 15 May 2026, requiring Federal Civilian Executive Branch agencies to apply mitigations by 29 May 2026. While that mandate covers US federal bodies, CISA's KEV additions are a reliable indicator of exploitation maturity and are widely used by enterprise security teams globally as a prioritisation signal. No details on the specific threat actor or campaign behind the exploitation have been disclosed at this stage. The scale of attacks and whether any have been successful against specific organisations remain unknown. Organisations should not wait for that clarity before acting. The MENA Cyber Wire threat intelligence archive will be updated as further attribution information becomes available.