🚨 Critical security alert: Microsoft has disclosed a zero-day vulnerability in on-premises Exchange Server that is actively being exploited in the wild. If your organisation runs any on-prem Exchange deployment, this is your cue to act right now.

What Happened?

On May 14, 2026, Microsoft released an out-of-band security advisory for CVE-2026-42897 — a high-severity reflected Cross-Site Scripting (XSS) vulnerability affecting Outlook Web Access (OWA) in Microsoft Exchange Server. The vulnerability was discovered as a zero-day, meaning attackers were already exploiting it before a patch was publicly available.

Microsoft’s Exchange Emergency Mitigation Service (EEMS) has already pushed mitigations automatically to supported Exchange Server versions, but an official cumulative update (CU) patch is still being developed. This is a classic race between defenders patching and attackers weaponising the flaw.

Technical Breakdown — How the Attack Works

CVE-2026-42897 is a reflected XSS flaw in Exchange’s OWA component. Here’s the attack chain broken down step by step:

1. An unauthenticated attacker sends a specially crafted email to a target user within your organisation.
2. The email contains malicious JavaScript embedded in a URL parameter — no macros, no attachments needed.
3. When the recipient opens the email in Outlook Web Access and interacts with specific elements, the script automatically executes within the victim’s browser context.
4. The attacker then has the ability to steal session cookies, read emails, create inbox rules, enumerate contacts, and potentially move laterally into the Microsoft 365 environment.

The most alarming aspect? No user interaction beyond viewing the email in OWA is strictly required under certain conditions — the attacker doesn’t need the victim to click anything. Microsoft rates this CVSS 8.1 (High severity), and the security community expects public proof-of-concept exploit code to surface within days.

Who Is Affected?

Any organisation running on-premises Microsoft Exchange Server — particularly those operating hybrid deployments or fully on-prem environments without Exchange Online. Cloud-only Microsoft 365 customers are not affected by this vulnerability.

Specifically impacted versions include:

• Exchange Server 2016 — all supported Cumulative Update versions
• Exchange Server 2019 — all supported Cumulative Update versions

One important caveat: Microsoft’s EEMS can only apply automatic mitigations to Exchange servers running CUs released after March 2023. If you’re on older versions, you’ll need to manually apply the Exchange Emergency Mitigation Tool (EEMT) or apply firewall-level restrictions while a full patch is prepared.

Threat Actor Context — Why This Is a Big Deal

While Microsoft has not officially attributed the exploitation to a named threat group, historical patterns give defenders strong reason for concern. On-premises Exchange has been the initial access vector of choice for multiple high-profile breaches over the past several years — including Hafnium’s 2021 Exchange server attacks that compromised tens of thousands of organisations globally.

Exchange zero-days are prized by both state-sponsored APT groups (for persistent access to high-value targets) and ransomware operators (who use email access to facilitate Business Email Compromise and data exfiltration). The active exploitation status means defenders should operate on the assumption that campaigns are already underway.

Real-World Impact — What an Attacker Can Do With This

Let’s be concrete about the threat. Once an attacker successfully exploits CVE-2026-42897 via OWA:

• Email exfiltration: Read any email in the victim’s mailbox, including sensitive business communications, invoices, and credentials.
• Identity spoofing: Send emails as the victim to internal and external contacts — perfect for fraud or deeper phishing campaigns.
• Internal reconnaissance: Map out the organisation’s structure, identify executives or finance staff, and plan secondary attacks.
• Lateral movement: Use harvested credentials or session tokens to pivot into Microsoft 365, Azure AD, or other connected SaaS applications.

This is not a theoretical vulnerability — it’s a fully functional pathway to full domain compromise if combined with other weaknesses commonly found in enterprise environments.

How to Protect Your Organisation — Right Now

Since the official cumulative update patch isn’t available yet, here’s your prioritised action checklist:

✅ Step 1: Verify or Enable the Exchange Emergency Mitigation Service (EEMS)
Check your Exchange Admin Center (EAC) to confirm EEMS is turned ON. This allows Microsoft to push mitigations automatically via the Exchange Emergency Mitigation Tool (EEMT) without waiting for a full CU. Run Get-ExchangeServer | Select-Object Name, EEMSEnabled in Exchange Management Shell to check status.

✅ Step 2: Audit OWA Access and Restrict by IP
Temporarily restrict OWA access to known, trusted IP ranges using IIS IP Restrictions or your perimeter firewall. This buys critical time while the patch is finalised.

✅ Step 3: Review OWA and IIS Logs for Indicators of Compromise
Search your IIS/OWA logs for unusual query parameters, especially around email ID fields that deviate from standard Exchange URL patterns. Look for

0 Shares

Share

Tweet

Share