CyberSIXT Search
Original
Image: SecurityWeek

SecurityWeekEduard Kovacs

Microsoft fixes active Exchange bug CVE-2026-42897.

Part of the CVE-2026-42897 story · 14 articles · 9 outlets · since 15 May

Microsoft released Patch Tuesday updates that address an actively exploited vulnerability in Exchange Server, tracked as CVE-2026-42897. This vulnerability is a spoofing and XSS flaw affecting Exchange Server Subscription Edition and versions 2016 and 2019. CISA added it to its Known Exploited Vulnerabilities catalog, mandating action by federal agencies. The vulnerability could allow attackers to execute arbitrary JavaScript via specially crafted emails.

Microsoft released patches on June 9 and advised immediate installation. Exploitation of Exchange vulnerabilities has decreased, with only one new entry in 2026 thus far.

AI summary of the original article from SecurityWeek, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made

Story timeline CVE-2026-42897

Full timeline
Show as table
CVE-2026-42897 coverage
Published (UTC)OutletHeadline
Fri 15 May · 07:20 UTCThe Hacker NewsMicrosoft patches Exchange Server XSS spoof flaw CVE-2026-42897
Fri 15 May · 12:10 UTCSecurityWeekMicrosoft warns of zero day Exchange flaw CVE-2026-42897
Fri 15 May · 12:40 UTCInfosecurityMicrosoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers
Fri 15 May · 14:30 UTCSecurity AffairsCVE-2026-42897: Microsoft warns of active Exchange XSS flaw
Fri 15 May · 18:20 UTCCISACISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog
Fri 15 May · 19:20 UTCCISACISA flags CVE‑2026‑42897 in Exchange, urges immediate patch
Fri 15 May · 19:27 UTCCISACISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list
Sat 16 May · 18:21 UTCSecurity AffairsCISA flags Exchange zero day flaw CVE-2026-42897 in KEV list
Mon 18 May · 15:42 UTCThe Hacker NewsMicrosoft Exchange zero day bug exploited in the wild
Mon 18 May · 22:12 UTCDark ReadingMicrosoft Exchange Zero-Day Under Attack, No Patch Available
Thu 11 Jun · 07:07 UTCSecurityWeekMicrosoft fixes active Exchange bug CVE-2026-42897. (this article)
Wed 29 Jul · 14:43 UTCSecurityOnlineTA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook
Wed 29 Jul · 15:20 UTCInfosecurityTA488 employs half‑click OWA exploit against government targets
Thu 30 Jul · 21:30 UTCArs TechnicaRussian hackers use Exchange XSS bug to plant OWAReaper

Sources

Original articlesecurityweek.comPrimary sourcemsrc.microsoft.com

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device