CVE-2026-42897

Microsoft Exchange Server Spoofing Vulnerability

criticalKEV: actively exploited PoC EPSS 71%

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Source: MSRC CVELISTV5 EUVD CISA_KEV CVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 8.1 and an EPSS percentile of 99.4 %, this vulnerability sits among the most likely-to-be-exploited issues tracked today — the low attack complexity (AC:L) and absence of any privilege requirement (PR:N) mean that any attacker who can deliver a crafted link to an OWA user has a viable exploitation path. The UI:R condition is trivially satisfied via phishing, making privileged Exchange users — particularly those with Organisation Admin or Domain Admin rights — the highest-risk targets. For NIS2-obligated organisations running on-premises Exchange (common in KRITIS sectors such as energy, healthcare, and finance), the C:H/I:H impact scores translate directly to potential full compromise of mailbox content and session integrity. Although CISA has not flagged known ransomware campaign use, the attack vector is well-suited as an initial-access mechanism for credential harvesting and lateral movement within Exchange-adjacent Active Directory environments, and should be treated as a critical patch priority regardless of ransomware flag status.

Runbook · Step 1

Immediate response (0-24 h)

Apply the vendor patch immediately: Microsoft has released a fix for CVE-2026-42897 — look up the exact KB number and target Exchange Server build in the current Microsoft Security Update Guide and deploy to all on-premises Exchange Server instances. Prioritise internet-facing servers first.
Disable or gate OWA behind VPN/reverse proxy if the patch cannot be deployed within 4 hours. OWA is the primary attack surface (AV:N, UI:R); removing direct internet exposure eliminates the unauthenticated attack path.
Invalidate all active OWA sessions: Recycle the OWA application pool via Exchange Management Shell (Restart-WebAppPool MSExchangeOWAAppPool) to force re-authentication and invalidate any potentially hijacked session tokens.
Restrict OWA access for privileged accounts: Disable OWA for Exchange Organisation Admins, Domain Admins, and Hybrid Connector accounts until patching is complete (Set-OwaMailboxPolicy -OwaEnabled $false scoped to admin groups).
Enable WAF rules targeting OWA XSS payloads on all reverse proxies or load balancers in front of Exchange — see Mitigation layers for specific rule guidance.
Preserve evidence: Archive IIS logs from the past 72 hours to your SIEM before log rotation occurs; raise SOC alert level for Exchange-related detections.

Runbook · Step 2

Mitigation layers

WAF/IPS rule: Inspect inbound HTTP requests to /owa/ and /ecp/ for XSS patterns — Suricata example: alert http any any -> $EXCHANGE_SERVER 443 (msg:"CVE-2026-42897 OWA XSS attempt"; content:"/owa/"; http_uri; pcre:"/<script|javascript:|on\w+\s*=/i"; sid:2026428970; rev:1;). Enable OWASP CRS rule set REQUEST-941-APPLICATION-ATTACK-XSS in ModSecurity.
Network segmentation: Place Exchange servers in a dedicated VLAN; restrict outbound connections from Exchange to known Microsoft service endpoints only — this limits exfiltration channels if a session is hijacked.
Enforce Content Security Policy (CSP): Inject Content-Security-Policy: default-src 'self'; script-src 'self' as a response header for all OWA responses via IIS URL Rewrite or ARR — significantly reduces the executability of injected scripts even if the XSS payload is delivered.
Enforce MFA for all OWA access: Because the attack targets session hijacking and spoofing (CVSS C:H, I:H), strong authentication materially reduces the blast radius — enforce via Azure AD Conditional Access or ADFS claims-based MFA policy.
Anti-phishing controls: The UI:R condition is most easily satisfied via phishing emails containing crafted OWA links. Tighten anti-phishing policies in Microsoft Defender for Office 365 or your email gateway to block lookalike OWA URLs and suspicious redirect chains.
Least-privilege for IIS application pool identities: Ensure Exchange app pool accounts run as NetworkService with no direct AD write permissions, limiting post-exploitation impact.

Runbook · Step 3

Detection rules

IIS access log analysis (OWA endpoints): Search for URL-encoded script tags or event-handler attributes in GET/POST requests to /owa/: SPL: index=iis cs-uri-stem="/owa/*" (cs-uri-query="*%3Cscript*" OR cs-uri-query="*javascript%3A*" OR cs-uri-query="*onerror*") | stats count by c-ip, cs-uri-stem, cs-uri-query

Sigma rule shape (IIS log source):

title: CVE-2026-42897 OWA XSS Probe
logsource: {product: iis}
detection:
  keywords|contains|any:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
  filter_uri: cs-uri-stem|startswith: '/owa/'
condition: keywords and filter_uri

Sysmon EID 3 — outbound network connections from IIS worker process: Flag any outbound connection from w3wp.exe to external IPs not in the Microsoft service IP range — a strong indicator of post-exploitation data exfiltration following session hijacking.
Windows Security Event IDs 4624 / 4648: Anomalous logons to Exchange resources from unfamiliar source IPs shortly after OWA session activity — KQL: SecurityEvent | where EventID in (4624,4648) | where TargetServerName contains "exchange" | where IpAddress !in (known_ip_list).
Proxy/EDR browser telemetry correlation: Flag client-side outbound requests to unknown domains with an OWA Referer header within a 30-second window — indicative of JavaScript executing a beacon or credential-exfiltration callback.

Metrics

Severity

critical

Priority score

223.38

KEV status

Actively exploited

Exploit maturity

actively exploited (KEV)

XIEM Effective CVSS

8.1

Source: nvd-v3

CVSS v3

8.1

CVSS v4

—

EPSS percentile

99.4 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

71.2 %

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Published

2026-05-14 07:00 UTC

CWE

CWE-79

Weakness classes (CWE)

CWE-79Base
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

Modified Analysis2026-06-15 19:19 UTC· nvd@nist.gov
- CPE Configuration: OR *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:-:*:*:*:subscription:*:*:* → OR *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:* versions up to (excluding) 15.02.2562.043

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

CISA KEV Catalogactively exploited (KEV)
CISA Known Exploited Vulnerabilityhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog#CVE-2026-428972026-05-15 00:00 UTC

References & sources

Linked advisories

IDCVE-2026-42897