Microsoft Exchange Server CVE-2026-42897, a cross-site scripting vulnerability under…
Microsoft Exchange Server CVE-2026-42897, a cross-site scripting vulnerability under active exploitation, allows arbitrary code execution via specially crafted emails.
Microsoft has disclosed CVE-2026-42897, a cross-site scripting vulnerability in Exchange Server that is being actively exploited in the wild. The vulnerability affects multiple versions of Exchange Server, including the Subscription Edition, Exchange 2019 (CU14 and CU15), and Exchange 2016 (CU23). An attacker can exploit this flaw by sending a specially crafted email to a user; if opened in Outlook Web Access under certain conditions, arbitrary JavaScript executes in the browser context with the victim's permissions.
Successful exploitation allows attackers to steal sensitive data, install malware, or hijack victim systems. Microsoft has released a temporary mitigation through the Exchange Emergency Mitigation Service and published guidance for organizations to address the vulnerability. The active exploitation status elevates the urgency for immediate patching.
The MS-ISAC rates this vulnerability as high risk across government, business, and home user segments. Organizations are advised to apply patches immediately after testing, implement DNS filtering and URL blocking, deploy network intrusion detection/prevention solutions, and maintain robust vulnerability management processes. The attack vector requires user interaction via phishing, making security awareness and email filtering critical defense layers.
Mentioned in this report
Detection guidance
Possible XSS Exploitation Attempt Against Exchange OWA/ECP (CVE-2026-42897)
Detects HTTP requests to Exchange OWA or ECP endpoints containing script injection patterns consistent with CVE-2026-42897 XSS exploitation delivered via phishing links/emails. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible XSS Exploitation Attempt Against Exchange OWA/ECP
id: b4a971f2-402d-5458-8019-05d256c3960e
status: experimental
description: 'Detects web requests to Microsoft Exchange OWA or ECP endpoints containing
common
cross-site scripting payload patterns (script tags, javascript: URIs, event handler
injection). CVE-2026-42897 is exploited by sending a victim a crafted email/link
that, when opened in Outlook Web Access, causes arbitrary JavaScript execution in
the browser context. This rule looks for the resulting malicious request patterns
hitting the OWA/ECP web application.
'
references:
- https://msrc.microsoft.com/
author: Vorant
tags:
- attack.T1566
logsource:
category: webserver
product: iis
detection:
selection_path:
cs-uri-stem|contains:
- /owa/
- /ecp/
selection_xss:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- String.fromCharCode
filter_common_assets:
cs-uri-query|contains:
- themes/
- .css
- .png
- .woff
condition: selection_path and selection_xss and not filter_common_assets
falsepositives:
- Legitimate OWA customization or theming scripts referencing inline JavaScript parameters
- Security scanners or penetration testing tools probing OWA for XSS as part of authorized
assessments
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-exchange-server-could-allow-for-arbitrary-code-execution_2026-050
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free