Microsoft is warning that attackers are actively exploiting CVE-2026-42897, a critical cross-site scripting flaw in on-premises Exchange Server that can let an unauthorized attacker perform spoofing over a network. The issue affects Exchange Server Subscription Edition RTM, Exchange Server 2019, and Exchange Server 2016, while Exchange Online is not impacted.
The bug was flagged by an anonymous researcher and carries a CVSS score of 8.1, according to The Hacker News. Microsoft said an attacker could abuse the flaw by sending a specially crafted email to a target, which, if opened in Outlook Web Access and combined with certain interaction conditions, may allow arbitrary JavaScript to run in the browser context. Both Help Net Security and The Hacker News said Microsoft has tagged the issue with an “Exploitation Detected” assessment.
Microsoft has not shared details about the in-the-wild activity, including who is behind it, who is being targeted, or whether the attacks have been successful. That uncertainty aside, the company says it is working on a permanent fix and plans to release updates for Exchange SE RTM, Exchange 2016 CU23, and Exchange Server 2019 CU14 and CU15, with updates for Exchange 2016 and 2019 limited to customers enrolled in the Period 2 Exchange Server ESU program, Help Net Security reported.
Until a patch arrives, Microsoft is leaning on temporary mitigations through the Exchange Emergency Mitigation Service, which is enabled by default and can apply the mitigation automatically. If that service is not available, Microsoft also pointed to the Exchange on-premises Mitigation Tool, or EOMT, which can be run manually on affected servers. The Hacker News said Microsoft noted the mitigation is delivered through a URL rewrite configuration and described one cosmetic issue where the tool may display “Mitigation invalid for this exchange version” even when the status shows as applied.
The disclosure adds to a busy stretch for Exchange administrators, but the immediate focus is narrow: Microsoft says this flaw is already being used in attacks, and the company is still preparing the permanent update. For now, organizations running impacted on-premises versions are on notice that the exposure is live, not theoretical.