CVE
CVE-2026-42897
- First Reported
- Jul 28, 2026
- Latest Reported
- Aug 7, 2026
CVE Enrichment
- CVSS
- 6.1 MEDIUM
- EPSS
- 0.52%
- EPSS Percentile
- 42.40%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- secure@microsoft.com
- Published
- 15-May-2026 01:16
- Last Modified
- 17-Jun-2026 17:48
- EPSS Date
- 2026-10-10
- CWE
- CWE-79
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:R /
S:C /
C:L /
I:L /
A:N
CISA KEV Details
- Date Added
- 2026-05-15
- Remediation Due
- 2026-05-29
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897
Affected Products / Versions
- microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:* - microsoft / exchange_server_subscription_edition
Version / affected range: * · before (exclusive) 15.02.2562.043
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (2)
- CVE-2026-42897 Recorded Future Identifies 85 High-Impact Vulnerabilities in July, Many Actively Exploited
- Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
CVE (80)
Malware (5)
Threat Actors (10)
MITRE ATT&CK (9)
Vendors (25)
Products (73)
Tools (2)
Industries (6)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.