Exchange Server zero-day exploited via XSS
An actively exploited Exchange Server vulnerability lets unauthenticated attackers bypass security via a malicious email opened in Outlook Web Access.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-42897 as exploited in the wild.
CERT-FR issued an alert regarding CVE-2026-42897, a vulnerability affecting multiple Microsoft Exchange Server versions including 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM. The flaw allows an unauthenticated attacker to perform indirect remote code injection (XSS) and bypass security policy when a targeted user opens a crafted email in Outlook Web Access. Microsoft confirmed the vulnerability is being actively exploited in the wild.
Microsoft published an advisory on 14 May 2026 and has provided interim mitigation through the Exchange Emergency Mitigation Service, which is enabled by default and operates automatically; disconnected environments require manual application of the mitigation per a published blog procedure. On 9 June 2026, Microsoft released corrective patches. CERT-FR recommends organizations monitor vendor announcements and apply patches promptly, alongside referencing guidance on email account compromise containment and qualification.
Mentioned in this report
Detection guidance
Exchange Worker Process Spawning Command Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Exchange OWA/ECP IIS worker process (w3wp.exe) spawning a command shell or scripting engine, the typical on-host execution outcome once an Exchange server-side RCE (e.g. CVE-2026-42897 style OWA XSS-to-RCE chains) is triggered. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange Worker Process Spawning Command Interpreter
description: Detects w3wp.exe running under an Exchange OWA/ECP application pool spawning
cmd.exe, powershell.exe, mshta.exe or similar interpreters. This is the generic
post-exploitation behaviour observed when an Exchange server-side vulnerability
(including OWA XSS-to-RCE chains such as CVE-2026-42897) is successfully exploited,
rather than a specific exploit artefact.
tags:
- attack.execution
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains:
- MSExchangeOWAAppPool
- MSExchangeECPAppPool
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Legitimate Exchange management scripts or scheduled maintenance tasks that invoke
PowerShell from the OWA/ECP app pool (rare, should be verified against known admin
activity)
- Third-party Exchange monitoring or backup agents hooking into the IIS worker process
level: high
id: 6c18a018-1787-552b-9e74-6580d7ccc1d0
status: experimental
author: Vorant
Outlook Spawning Script Interpreter After Email Rendering
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects OUTLOOK.EXE spawning a script host (wscript/cscript/mshta) shortly after rendering content, consistent with a crafted email exploiting a client-side script injection (XSS) flaw to escape into native script execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outlook Spawning Script Interpreter After Email Rendering
description: Detects Outlook (OUTLOOK.EXE) directly spawning script interpreters such
as wscript.exe, cscript.exe or mshta.exe. Outlook does not normally launch these
interpreters as part of routine mail handling; this pattern is consistent with a
crafted email/OWA-rendered message exploiting a script injection (XSS) vulnerability
that escapes into native script execution on the client or via a mailbox-hosted
component.
tags:
- attack.execution
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \OUTLOOK.EXE
Image|endswith:
- \wscript.exe
- \cscript.exe
- \mshta.exe
filter_addins:
CommandLine|contains:
- Program Files\Microsoft Office
- AddIns
condition: selection and not filter_addins
falsepositives:
- Legitimate Outlook add-ins or macros that legitimately invoke script hosts from
an installed Office/AddIns path
- Custom internal tooling integrated with Outlook via COM add-ins
level: medium
id: 4e48db49-4e3c-52f3-a2b9-70b29d2a7b07
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-005
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs