Microsoft Exchange Server Cross-Site Scripting Vulnerability

Summary

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Remediation

1. Inventory every Microsoft Microsoft deployment, including staging.
2. Upgrade Microsoft Microsoft to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.
4. Review logs from before the change for signs of exploitation.

References

• Patchhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
• Advisoryhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897
• Advisoryhttps://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-42897
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897