Exchange Server zero-day exploited via XSS
An actively exploited Exchange Server vulnerability lets unauthenticated attackers bypass security via a malicious email opened in Outlook Web Access.
CERT-FR issued an alert regarding CVE-2026-42897, a vulnerability affecting multiple Microsoft Exchange Server versions including 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM. The flaw allows an unauthenticated attacker to perform indirect remote code injection (XSS) and bypass security policy when a targeted user opens a crafted email in Outlook Web Access. Microsoft confirmed the vulnerability is being actively exploited in the wild.
Microsoft published an advisory on 14 May 2026 and has provided interim mitigation through the Exchange Emergency Mitigation Service, which is enabled by default and operates automatically; disconnected environments require manual application of the mitigation per a published blog procedure. On 9 June 2026, Microsoft released corrective patches. CERT-FR recommends organizations monitor vendor announcements and apply patches promptly, alongside referencing guidance on email account compromise containment and qualification.
Mentioned in this report
Detection guidance
Exchange Worker Process Spawning Command Interpreter
Detects the Exchange OWA/ECP IIS worker process (w3wp.exe) spawning a command shell or scripting engine, the typical on-host execution outcome once an Exchange server-side RCE (e.g. CVE-2026-42897 style OWA XSS-to-RCE chains) is triggered. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange Worker Process Spawning Command Interpreter
description: Detects w3wp.exe running under an Exchange OWA/ECP application pool spawning
cmd.exe, powershell.exe, mshta.exe or similar interpreters. This is the generic
post-exploitation behaviour observed when an Exchange server-side vulnerability
(including OWA XSS-to-RCE chains such as CVE-2026-42897) is successfully exploited,
rather than a specific exploit artefact.
tags:
- attack.execution
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains:
- MSExchangeOWAAppPool
- MSExchangeECPAppPool
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Legitimate Exchange management scripts or scheduled maintenance tasks that invoke
PowerShell from the OWA/ECP app pool (rare, should be verified against known admin
activity)
- Third-party Exchange monitoring or backup agents hooking into the IIS worker process
level: high
id: 6c18a018-1787-552b-9e74-6580d7ccc1d0
status: experimental
author: Vorant
Outlook Spawning Script Interpreter After Email Rendering
Detects OUTLOOK.EXE spawning a script host (wscript/cscript/mshta) shortly after rendering content, consistent with a crafted email exploiting a client-side script injection (XSS) flaw to escape into native script execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outlook Spawning Script Interpreter After Email Rendering
description: Detects Outlook (OUTLOOK.EXE) directly spawning script interpreters such
as wscript.exe, cscript.exe or mshta.exe. Outlook does not normally launch these
interpreters as part of routine mail handling; this pattern is consistent with a
crafted email/OWA-rendered message exploiting a script injection (XSS) vulnerability
that escapes into native script execution on the client or via a mailbox-hosted
component.
tags:
- attack.execution
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \OUTLOOK.EXE
Image|endswith:
- \wscript.exe
- \cscript.exe
- \mshta.exe
filter_addins:
CommandLine|contains:
- Program Files\Microsoft Office
- AddIns
condition: selection and not filter_addins
falsepositives:
- Legitimate Outlook add-ins or macros that legitimately invoke script hosts from
an installed Office/AddIns path
- Custom internal tooling integrated with Outlook via COM add-ins
level: medium
id: 4e48db49-4e3c-52f3-a2b9-70b29d2a7b07
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-005
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free