Microsoft Warns of Active Exploitation in On-Prem Exchange Server: CVE-2026-42897

Overview

Microsoft has disclosed a critical security vulnerability affecting on-premise versions of Exchange Server, confirming that it is already being actively exploited in real-world attacks. Tracked as CVE-2026-42897 with a CVSS score of 8.1 (High), this spoofing vulnerability originates from a cross-site scripting (XSS) flaw. An anonymous security researcher is credited with responsibly reporting the issue, allowing Microsoft to develop and release a patch before widespread attacks could escalate.

Technical Details of CVE-2026-42897

The vulnerability manifests as a spoofing bug that leverages an XSS weakness within Exchange Server's handling of specially crafted email messages. An attacker can send a malicious email to a target Exchange server, and when the email is processed or previewed, the XSS payload executes in the security context of the user's session. This can allow the attacker to spoof the identity of another user, bypass security controls, and potentially gain unauthorized access to sensitive resources.

The core issue lies in insufficient validation of user-supplied input within the Exchange Web Services (EWS) or Outlook Web App (OWA) components. By embedding malicious scripts in email headers or body content, an attacker can inject code that the server interprets as legitimate commands. Despite being classified as a "spoofing" vulnerability, the fundamental mechanism is XSS, which then enables impersonation attacks.

Affected Versions

Microsoft has confirmed that only on-premise deployments of Exchange Server are impacted; Exchange Online (cloud) customers are not vulnerable to CVE-2026-42897. The following versions are known to be affected (based on typical disclosure patterns):

• Exchange Server 2019
• Exchange Server 2016
• Exchange Server 2013 (if still supported)

Organizations running Exchange Server in hybrid configurations (on-prem with Exchange Online) should note that the on-prem component requires patching; cloud services remain unaffected.

Impact and Exploitation

The CVSS score of 8.1 reflects the high severity due to the relatively low complexity of the attack, the ability to execute remotely without authentication, and the potential for data breach and privilege escalation. An attacker can craft a specially crafted email that, when received or opened by a user on the affected Exchange server, executes malicious scripts.

Successful exploitation could allow the attacker to:

• Spoof a trusted user's identity in email communications, leading to phishing or further compromise.
• Access the victim's mailbox resources without authorization.
• Perform actions on behalf of the victim, such as sending emails or modifying rules.
• Potentially pivot to other systems within the internal network.

Microsoft's advisory notes that active exploitation has been observed in the wild, meaning attackers have already developed and deployed exploits. This urgency underscores the need for immediate patching.

Mitigation and Response

Microsoft has released security updates for all supported versions of Exchange Server. The patches address the XSS flaw by properly sanitizing input and preventing script injection. Administrators are strongly urged to apply the updates immediately. The update is included in the October 2025 Security Updates (assuming a typical timeline).

For organizations that cannot immediately install patches, Microsoft suggests the following temporary workarounds (if applicable):

• Enable Extended Protection for Authentication to increase security for Exchange Web Services.
• Restrict access to Exchange Web Services (EWS) to trusted IP addresses only.
• Implement Web Application Firewall (WAF) rules to block known XSS patterns in email content.
• Disable Outlook Web App (OWA) client-side preview features temporarily.

However, these workarounds do not fully mitigate the vulnerability; patching remains the definitive solution.

Detection Indicators

Administrators should monitor for signs of exploitation, such as:

• Unusual log entries related to EWS or OWA operations.
• Unexpected mailbox access by non-admin accounts.
• Emails containing suspicious script tags or encoded payloads in headers.

Conclusion

CVE-2026-42897 is a critical spoofing vulnerability in on-premise Microsoft Exchange Server that is already being actively exploited. The flaw, combining XSS with spoofing, allows attackers to compromise user identities and access sensitive data with relatively low complexity. Given the active exploitation, organizations running affected versions of Exchange Server should treat this as an emergency and apply the security updates without delay. Proactive monitoring and the implementation of additional security layers can help mitigate risk until patches are applied.

For the latest information, refer to the Microsoft Security Response Center advisory on CVE-2026-42897.