CVE intelligenceCISA KEV

CVE-2026-42897

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Published May 14, 2026Sources checked Sep 27, 2026

6.1MEDIUMCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-42897 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Microsoft.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Not collected. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

Microsoft Security Response Center: Exploitation reported by Microsoft Security Response Center (2026-07-14)

CISA KEVListedObserved exploitation

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-42897?

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.