CVE-2026-42897

This vulnerability is a weakness in how Exchange’s web mail pages handle information, which can let an attacker run harmful “scripts” inside your users’ browsers. In real incidents, attackers trick someone into opening a crafted email, and that can lead to spoofed messages and help the attacker stay inside the email system to steal credentials and sensitive data.

This matters to you if you run Microsoft Exchange Server using Outlook Web Access (OWA) for users to read email in a web browser. It affects specific Exchange Server builds listed for Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, and Microsoft Exchange Server Subscription Edition RTM.

It’s a risk in practice when an attacker can reach your users’ OWA sessions through a malicious email that users open (a “half-click”/user interaction is required).

This is RED because it is confirmed in the CISA KEV and has real-world reports of active exploitation. Attackers are using it to run JavaScript in victims’ browsers via specially crafted emails, then using that access to gain persistent control (OWAReaper) and steal credentials and sensitive information.

1. Confirm exposure (your Exchange version)

   • On the Exchange server, identify your exact build/version and compare it to the affected ones: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, and Microsoft Exchange Server Subscription Edition RTM.
   • Also confirm which “exchange server subscription edition” build you are actually running (the fixed version listed is the same for Subscription Edition RTM and exchange server subscription edition).

2. Confirm the user path attackers use

   • Determine whether your users access email via Outlook Web Access (OWA) in a web browser.
   • Validate that typical user actions (opening emails) can trigger the vulnerable web UI rendering.

3. Patch to the fixed versions (primary action)

   • Exchange 2016 Cumulative Update 23 → upgrade to 15.01.2507.069.
   • Exchange 2019 Cumulative Update 14 → upgrade to 15.02.1544.041.
   • Exchange 2019 Cumulative Update 15 → upgrade to 15.02.1748.046.
   • Exchange Subscription Edition RTM → upgrade to 15.02.2562.043.

4. If patching is delayed (workaround/compensating measures)

   • Follow Microsoft’s compensating measures and workarounds from the update guide for CVE-2026-42897 immediately (use the Microsoft update guide referenced in the official remediation instructions).

5. Guidance based on CISA KEV timing

   • CISA remediation due date: 2026-05-29.
   • Given confirmed exploitation, prioritize completing the upgrade before that date.

6. Post-upgrade monitoring

   • Watch for signs of OWA-based compromise behaviors consistent with the reported attack pattern: suspicious mailbox access, unexpected authentication events, and any evidence of OWA page/script execution tied to email-opening flows.
   • Keep monitoring for persistence attempts (the reported backdoor is named OWAReaper) even after patching, because attackers may have acted before the update.

CVE-2026-42897 is a cross-site scripting (XSS) flaw (CWE-79) in Microsoft Exchange Server’s Outlook Web Access (OWA). The practical mechanism reported is that attackers can deliver a specially crafted email that causes injected JavaScript to execute when a user opens the message in the OWA web interface (user interaction is required; no authentication is required for the attacker per the findings).

Exploitation status: This vulnerability is included in the CISA KEV (added 2026-05-15) and has real-world exploitation reports (first reported 2026-06-11) involving named threat actors Laundry Bear (Void Blizzard, TA488). Reports indicate the exploit can enable stealthy deployment of a persistent backdoor called OWAReaper and lead to credential and sensitive data theft.

Fix availability: Microsoft provides fixed versions for each affected Exchange branch, with specific build targets listed in the findings. If mitigations are not available, CISA guidance is to discontinue use of the product; otherwise apply vendor mitigations/workarounds as instructed.

Note on EPSS: A predicted likelihood exists in the findings, but because KEV/news confirm exploitation, this should not be treated as the primary driver for urgency.