CVE Tools
Track your stack

Microsoft patches Exchange Server zero-day exploited in attacks

BleepingComputerBy Sergiu Gatlan

Reported exploitedExchange Server 2016Exchange Server 2019

Our summary

Microsoft released security updates for a zero-day in Microsoft Exchange Server that has been exploited in real-world attacks, enabling attackers to run arbitrary JavaScript via a cross-site scripting (XSS) path that targets Outlook Web Access users. The issue, tracked as CVE-2026-42897, affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE), and can be triggered remotely by sending a crafted email without special privileges. This matters because the flaw allows malicious script execution in the victim’s browser context, increasing the risk of account and session compromise; defenders should apply the June 2026 fixes and keep the related mitigations enabled.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerNearly 22,000 Microsoft Exchange servers vulnerable to hijack attacksCVE-2024-21182, CVE-2026-42897
  2. The Hacker NewsThree Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and WipersCVE-2026-42897
  3. Help Net SecurityNearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)CVE-2026-42897
  4. The Hacker News⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS HijacksCVE-2026-42897
  5. Check Point Research3rd August – Threat Intelligence ReportCVE-2026-42897
  6. Help Net SecurityWeek in review: Claude breached three companies during tests, AD CS domain-takeover PoC releasedCVE-2026-42897
  7. Ars Technica (Security)Max-severity Exchange server flaw under active exploitation by Kremlin hackersCVE-2026-42897
  8. Help Net SecurityLaundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897)CVE-2026-42897
  9. The Hacker NewsRussian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential RotationCVE-2026-42897
  10. BleepingComputerRussian hackers exploit Exchange OWA zero-day for long-term mailbox accessCVE-2026-42897

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store