CVE-2026-42897: Exchange Server XSS exploited against Outlook on the web — mitigation available via EEMS

A newly disclosed Microsoft Exchange Server vulnerability, tracked as CVE-2026-42897, is being exploited in the wild and targets Outlook on the web (OWA) users. The issue is described as a cross-site scripting (XSS)–based spoofing vulnerability. Microsoft has not released patches yet, but it has published mitigations and says the Exchange Emergency Mitigation Service (EEMS) will automatically apply protections on supported on‑premises servers.

What we know so far

According to Microsoft’s security guidance and public reporting, CVE-2026-42897 is an XSS vulnerability in Microsoft Exchange Server that enables spoofing over a network. BleepingComputer reports that Microsoft warned of active exploitation and shared interim mitigations for administrators. The company indicates the following:

• Affected products: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).
• Attack scenario: An attacker can send a specially crafted email. If the recipient opens it in Outlook on the web and certain interaction conditions are met, arbitrary JavaScript may execute in the browser context. Microsoft classifies this as a spoofing issue rather than server-side code execution.
• Patch status: No security update is yet available.
• Mitigation path: The Exchange Emergency Mitigation Service (EEMS) will provide automatic mitigation for on‑premises Exchange 2016, 2019, and SE. Microsoft recommends enabling EEMS immediately if it is disabled.

Microsoft notes that EEMS may not be able to check for new mitigations on servers running Exchange builds older than March 2023. EEMS runs as a Windows service on Exchange Mailbox servers and is typically enabled on servers with the Mailbox role.

References:

• Microsoft Security Update Guide entry for CVE-2026-42897: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
• Microsoft Exchange Team post on the May 2026 vulnerability and mitigations: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498
• Coverage and summary via BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/
• Background on EEMS: https://www.bleepingcomputer.com/news/microsoft/new-microsoft-exchange-service-mitigates-high-risk-bugs-automatically/

Why it matters

Outlook on the web is widely exposed in many organizations, and XSS in a webmail context can enable content spoofing and deceptive UI behavior inside the user’s browser. With exploitation reported and no patch currently available, relying on Exchange’s built‑in emergency mitigation is the most practical immediate defense for on‑premises deployments.

Practical next steps

Based on Microsoft’s guidance and public reporting, administrators can take the following actions now:

• Enable the Exchange Emergency Mitigation Service (EEMS) on Exchange Server 2016, 2019, and SE. Microsoft characterizes this as the fastest way to reduce risk while a fix is pending.
• Ensure your Exchange servers are on builds from March 2023 or later so EEMS can check for and apply new mitigations.
• Monitor Microsoft’s CVE page and Exchange Team post linked above for updates and eventual patches.

What’s still unclear

Some details are not publicly specified at this time:

• The exact interaction conditions required in OWA for script execution are not fully described.
• Patch availability and timelines have not been announced in the sources reviewed.
• Scope of exploitation and impact details beyond the spoofing/XSS classification are not provided.

Bottom line

CVE-2026-42897 is an actively exploited Exchange Server XSS vulnerability that targets OWA users. Until patches arrive, Microsoft’s Exchange Emergency Mitigation Service is the recommended safeguard. Verify EEMS is enabled and your servers are on supported builds, then track Microsoft’s advisories for updates.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.