CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Exchange Server contains a cross-site scripting vulnerability in Outlook Web Access. Under certain interaction conditions during web page generation, an attacker can cause arbitrary JavaScript to execute in the browser context of a logged-in user. This matters because Exchange often handles sensitive corporate email and authentication tokens; successful exploitation can expose session data or allow actions on behalf of the victim without further credentials.

How it works

The weakness is classified as CWE-79, improper neutralization of input during web page generation. In Outlook Web Access, untrusted data reaches the page output without sufficient encoding or filtering. When the documented interaction conditions are present, the browser interprets attacker-controlled content as executable script rather than static text.

Am I affected? How to find it in your systems

Microsoft Exchange Server deployments that expose Outlook Web Access are the primary surface. Inventory on-premises Exchange servers and any configurations that allow external or internal access to OWA. Confirm exact versions and build numbers against the vendor advisory, as not all releases are affected. Review web server logs for anomalous requests that contain script tags or unusual parameters in OWA endpoints; correlate with authentication events that originate from unexpected user agents or IP addresses.

How to remediate

• Apply the vendor update named in the advisory as the primary step.
• After patching, re-enable any temporarily restricted OWA features only after validation in a test environment.
• Review and tighten content security policy headers for OWA virtual directories if the advisory permits such changes.

If you can't patch immediately

• Segment Exchange servers so that OWA traffic is reachable only from authorized internal networks or approved VPN endpoints.
• Apply virtual patching through a web application firewall that inspects and blocks known XSS patterns targeting OWA paths.
• Disable or restrict Outlook Web Access for user populations that do not require it, falling back to other clients.
• Increase monitoring of OWA-related authentication logs and browser-reported script errors for signs of attempted exploitation.

If your data may have been exposed

Actively exploited vulnerabilities of this class have led to account compromise and data access in past incidents. Run a free exposure scan of your organization's email domains against known breach data to identify any already-leaked credentials that could compound risk.