CVE-2026-42897: Exchange Server OWA Spoofing Flaw Exploited via Crafted Email

Microsoft has disclosed a vulnerability impacting on-premise versions of Exchange Server that is already seeing active exploitation in the wild. Tracked as CVE-2026-42897, the issue carries a CVSS score of 8.1 and affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition, while Exchange Online is not impacted. Microsoft describes it as a spoofing issue rooted in cross-site scripting that can be triggered when a user opens a specially crafted email in Outlook Web Access under certain interaction conditions.

From a defender’s perspective, the CVE-2026-42897 vulnerability matters because the exploit path does not begin with a server takeover. Instead, the attacker sends a crafted email that can lead to arbitrary JavaScript execution in the victim’s browser session when viewed through OWA, creating a route to spoofing and session abuse in the web client context. At the time of disclosure, Microsoft said exploitation had been detected, but public reporting did not identify the threat actor, targets, or overall campaign scale.

CVE-2026-42897 analysis

The vulnerability in CVE-2026-42897 is tied to improper neutralization of input during web page generation in Microsoft Exchange Server. According to Microsoft’s public explanation, an attacker can exploit the flaw by sending a specially crafted email to a user, which then executes attacker-controlled JavaScript in the browser when the message is opened in OWA and the required interaction conditions are met. In practical terms, the CVE-2026-42897 payload is the malicious email content itself rather than a dropped binary or server-side implant.

For security teams performing CVE-2026-42897 analysis, one key limitation is the current lack of deep public exploit detail. There is no public CVE-2026-42897 poc in the cited sources, and Microsoft has not published packet-level or forensic CVE-2026-42897 iocs. That means CVE-2026-42897 detection is more likely to rely on identifying exposed on-prem OWA deployments, monitoring suspicious email-driven browser activity, and verifying that Microsoft’s emergency mitigation has been applied across all eligible Exchange servers.

Explore Detections

CVE-2026-42897 Mitigation

Microsoft’s immediate CVE-2026-42897 mitigation guidance is to rely on the Exchange Emergency Mitigation Service, which applies protection automatically through a URL Rewrite configuration and is enabled by default on supported on-prem Exchange deployments. Microsoft says administrators should ensure the Windows service is enabled if it has been turned off. The company also states that this mitigation is a temporary measure while a permanent fix is being prepared.

If the Exchange Emergency Mitigation Service cannot be used, such as in air-gapped environments, Microsoft instructs administrators to deploy the latest Exchange On-premises Mitigation Tool (EOMT) and apply the CVE-specific mitigation either per server or across all Exchange servers through Exchange Management Shell. In practice, to Detect CVE-2026-42897 exposure, organizations should inventory all internet-facing on-prem Exchange systems, confirm whether the emergency mitigation was applied successfully, and prioritize OWA-enabled servers that remain externally reachable without the mitigation in place.