# Exchange Server XSS flaw exploited in wild

Published: 2026-05-15 · Severity: high
Canonical: https://vorant.io/reports/a275c293-2045-5c4f-b7fd-8bebfcea1a37/exchange-server-xss-flaw-exploited-in-wild

> Microsoft confirms active exploitation of CVE-2026-42897, a cross-site scripting vulnerability in Exchange Server allowing arbitrary JavaScript execution via malicious emails.

Microsoft Exchange Server contains a cross-site scripting vulnerability (CVE-2026-42897) that is under active exploitation in the wild. The flaw affects multiple versions of Exchange Server, including Subscription Edition RTM and versions 2016 and 2019. An attacker can exploit this vulnerability by sending a specially crafted email to a user; when opened in Outlook Web Access under certain conditions, arbitrary JavaScript executes in the browser context with the user's permissions, potentially allowing data theft, malware installation, or system compromise.

Microsoft has confirmed active exploitation and is providing temporary mitigation through the Exchange Emergency Mitigation Service while patches are being deployed. The vulnerability represents an improper neutralization of input during web page generation, allowing unauthorized attackers to perform spoofing attacks over the network.

Organizations running affected Exchange Server versions should immediately apply Microsoft's mitigations after appropriate testing and implement defense-in-depth measures including DNS filtering, network intrusion prevention, and web content restrictions to reduce exposure until patches can be fully deployed.

## Mentioned in this report

- Vulnerabilities: CVE-2026-42897 (KEV)

## Detection guidance (public sample)

### Potential XSS Payload in Exchange OWA/ECP Request

ATT&CK: T1189

Detects HTTP requests to Exchange OWA/ECP endpoints containing script-injection markers in the URI query string, consistent with exploitation of CVE-2026-42897. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential XSS Payload in Exchange OWA/ECP Request
id: 3f2210de-5fe9-5f7f-b430-550f9e886e82
status: experimental
description: 'Detects web requests to Exchange Outlook Web Access (OWA) or ECP endpoints
  containing

  common cross-site scripting payload markers in the query string, consistent with

  exploitation of CVE-2026-42897, an XSS flaw in Exchange Server that executes attacker

  JavaScript in the victim''s OWA session when a crafted email or link is opened.

  '
references:
- CVE-2026-42897
author: Vorant
tags:
- attack.T1189
- attack.initial-access
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
    - /owa/
    - /ecp/
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - String.fromCharCode
    - document.cookie
  condition: selection_path and selection_payload
falsepositives:
- Authorized web application vulnerability scanners (e.g., Qualys, Nessus, Burp Suite)
  testing OWA/ECP for XSS
- Security research or penetration testing activity against Exchange endpoints
level: medium
```

### Suspicious Child Process from Exchange OWA/ECP Worker Process

ATT&CK: T1189

Detects script/shell interpreters spawned by the IIS worker process hosting Exchange OWA/ECP application pools, indicating possible follow-on exploitation after an XSS-triggered compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Exchange OWA/ECP Worker Process
id: 461f3aed-456e-549c-a384-4f3cade24533
status: experimental
description: 'Detects command/script interpreters spawned from the IIS worker process
  (w3wp.exe)

  running the Exchange OWA or ECP application pools. This can indicate follow-on

  exploitation activity chained from a client-side XSS compromise (e.g., CVE-2026-42897)

  or another Exchange web-facing vulnerability leading to server-side code execution.

  '
references:
- CVE-2026-42897
author: Vorant
tags:
- attack.T1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains:
    - MSExchangeOWAAppPool
    - MSExchangeECPAppPool
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  filter_admin:
    CommandLine|contains:
    - Get-ExchangeServer
    - Test-ServiceHealth
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate Exchange management scripts or scheduled maintenance tasks invoked through
  IIS-hosted management tools
- Third-party OWA/ECP monitoring agents that shell out to PowerShell for health checks
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-exchange-server-could-allow-for-arbitrary-code-execution_2026-050

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a275c293-2045-5c4f-b7fd-8bebfcea1a37/exchange-server-xss-flaw-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup