Microsoft Exchange Server XSS flaw enables arbitrary code execution
Microsoft Exchange Server CVE-2026-42897, a cross-site scripting vulnerability under active exploitation, allows arbitrary code execution via specially crafted emails.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-42897 as exploited in the wild.
Microsoft has disclosed CVE-2026-42897, a cross-site scripting vulnerability in Exchange Server that is being actively exploited in the wild. The vulnerability affects multiple versions of Exchange Server, including the Subscription Edition, Exchange 2019 (CU14 and CU15), and Exchange 2016 (CU23). An attacker can exploit this flaw by sending a specially crafted email to a user; if opened in Outlook Web Access under certain conditions, arbitrary JavaScript executes in the browser context with the victim's permissions.
Successful exploitation allows attackers to steal sensitive data, install malware, or hijack victim systems. Microsoft has released a temporary mitigation through the Exchange Emergency Mitigation Service and published guidance for organizations to address the vulnerability. The active exploitation status elevates the urgency for immediate patching.
The MS-ISAC rates this vulnerability as high risk across government, business, and home user segments. Organizations are advised to apply patches immediately after testing, implement DNS filtering and URL blocking, deploy network intrusion detection/prevention solutions, and maintain robust vulnerability management processes. The attack vector requires user interaction via phishing, making security awareness and email filtering critical defense layers.
Mentioned in this report
Detection guidance
Possible XSS Exploitation Attempt Against Exchange OWA/ECP (CVE-2026-42897)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to Exchange OWA or ECP endpoints containing script injection patterns consistent with CVE-2026-42897 XSS exploitation delivered via phishing links/emails. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible XSS Exploitation Attempt Against Exchange OWA/ECP
id: b4a971f2-402d-5458-8019-05d256c3960e
status: experimental
description: 'Detects web requests to Microsoft Exchange OWA or ECP endpoints containing
common
cross-site scripting payload patterns (script tags, javascript: URIs, event handler
injection). CVE-2026-42897 is exploited by sending a victim a crafted email/link
that, when opened in Outlook Web Access, causes arbitrary JavaScript execution in
the browser context. This rule looks for the resulting malicious request patterns
hitting the OWA/ECP web application.
'
references:
- https://msrc.microsoft.com/
author: Vorant
tags:
- attack.t1566
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /owa/
- /ecp/
selection_xss:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- String.fromCharCode
filter_common_assets:
cs-uri-query|contains:
- themes/
- .css
- .png
- .woff
condition: selection_path and selection_xss and not filter_common_assets
falsepositives:
- Legitimate OWA customization or theming scripts referencing inline JavaScript parameters
- Security scanners or penetration testing tools probing OWA for XSS as part of authorized
assessments
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-exchange-server-could-allow-for-arbitrary-code-execution_2026-050
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs