A cross-site scripting flaw in Microsoft Exchange's web interface is being exploited in the wild — and as of this writing, there is still no permanent patch. Microsoft confirmed active exploitation of CVE-2026-42897 on 14 May 2026 (some reports place the announcement on 15 May; the NVD published date is 14 May), two days after its May Patch Tuesday addressed 138 separate vulnerabilities. The zero-day was not among them.

What the Flaw Does

CVE-2026-42897 is an improper input neutralisation (cross-site scripting) vulnerability in the Outlook Web Access (OWA) component of on-premises Microsoft Exchange Server. Microsoft, as the CNA, assigns it a CVSS v3.1 score of 8.1, which falls in the High severity band (7.0–8.9); NIST scores it 6.1 Medium using a different vector. Some outlets described it as "critical" — that label does not correspond to the official CVSS band at 8.1. An attacker exploits the flaw by sending a specially crafted email to a target user. If that user opens the message in OWA and certain interaction conditions are met, arbitrary JavaScript executes inside the victim's browser session.

Microsoft's own advisory states: "An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context." The consequence is execution within the victim's active browser session, not server-level code execution.

Microsoft has declined to specify publicly which interaction conditions trigger the exploit, a standard disclosure restraint intended to slow adversary refinement of working attack chains.

Affected Versions

The vulnerability affects all currently supported on-premises Exchange builds: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). Exchange Online — the cloud-hosted service used by Microsoft 365 customers — is not affected. The scope is significant because a large share of enterprise email, particularly in regulated industries and government, still runs on on-premises Exchange.

No Permanent Fix, Temporary Mitigations Available

Microsoft has not issued a permanent security update for CVE-2026-42897 and has not committed to a public timeline for one. Two mitigation paths are available in the interim. For organisations with the Exchange Emergency Mitigation Service (EEMS) enabled, Microsoft pushed an automatic mitigation — it is applied without administrator action. For air-gapped or internet-isolated environments, the Exchange On-premises Mitigation Tool (EOMT) provides a manual equivalent.

Administrators should verify that EEMS is active and the mitigation has been applied. Microsoft's official guidance on the Microsoft Community Hub lists the mitigation steps and notes known side effects: OWA print-calendar functionality, inline image rendering, and OWA light mode may malfunction after applying the temporary fix.

Regulatory Response: CISA

The United States Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42897 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 May 2026, according to the Security Affairs KEV report — the same day Microsoft disclosed the flaw. (SecurityWeek's initial report, published around the same time, noted the CVE had not yet been added; the KEV listing followed later that day.) Federal Civilian Executive Branch (FCEB) agencies were given until 29 May 2026 to remediate.

Why On-Premises Exchange Remains a High-Value Target

Exchange Server has featured in some of the most damaging enterprise breaches of the past decade. Unpatched Exchange instances are reliable initial-access vectors for both nation-state groups and ransomware operators, as the mail server holds credentials and internal correspondence and often has broad network reachability. CVE-2026-42897 does not grant direct server access, but JavaScript execution within an authenticated OWA session can be a decisive first step.

The phishing-style delivery mechanism lowers the barrier for mass exploitation. An attacker only needs to deliver a malicious email that a user opens in OWA; no direct network access to the Exchange server is required. Unlike vulnerabilities requiring attacker network access to Exchange directly, this flaw can be triggered remotely by any actor who can deliver email to the target organisation.

The permanent fix arrived in June, and it is not free for everyone

Microsoft shipped a code fix at the June Patch Tuesday as KB5094139, delivered in Subscription Edition RTM SU7. The Emergency Mitigation Service rules were the stopgap, and they were superseded rather than extended.

The distribution is the part that matters for anyone still running on-premises Exchange. Subscription Edition receives the update as part of normal servicing. Exchange Server 2016 and 2019 require Extended Security Updates, which have to be purchased.

That puts a paid gate in front of the fix for the two versions the majority of on-premises estates are still running. An organisation that had not budgeted for ESU discovered in June that its options were to buy it, migrate, or keep running an actively exploited flaw behind a mitigation service.

The mislabelling this piece flagged did not stop

Some outlets described the flaw as critical when the CVSS band at 8.1 is High, and that correction is worth restating because the drift has continued rather than settled.

Coverage of the June update has described CVE-2026-42897 as a critical unauthenticated remote code execution flaw. It is a cross-site scripting vulnerability requiring user interaction with a crafted message. Those are materially different things. A server compromised by a packet requires a different response than a user session compromised by an opened email.

The practical consequence is prioritisation. A team told it faces unauthenticated RCE on a mail server will drop everything, which is the right response to an RCE and an over-response here that costs attention elsewhere. NIST's 6.1 Medium and Microsoft's 8.1 High disagree with each other on this flaw; neither of them says critical.

Where this sits in a year of shortening windows

An actively exploited flaw with no code fix for roughly a month is unusual, and the surrounding pattern in 2026 has been the opposite problem.

Zimbra shipped 10.1.20 on 20 July, and CERT Polska did not observe exploitation until 17 August, a month after the fix existed. MLflow went the other way: CISA added CVE-2026-64849 to the exploited catalogue two days after disclosure, with honeypots capturing payloads aimed at cloud metadata endpoints.

The operational problem is not just patch speed, but knowing which of your exposures is being actively used by an adversary. A month-old patch nobody applied and a month-old flaw with no patch produce the same exposure, and only one of them shows up as an outstanding update in a vulnerability programme.

What an on-premises Exchange administrator should take from it

The Emergency Mitigation Service did the job it exists for, which is worth recording because it is usually discussed as a compliance checkbox.

EEMS applied a mitigation automatically to 2016, 2019 and SE while no fix existed. An estate that had disabled EEMS — a common practice where change control requires manual approval for every modification — spent that month exposed.

The durable lesson is about version support rather than this particular flaw. Running Exchange 2016 or 2019 now means that the response to the next actively exploited zero-day is a purchasing decision taken under time pressure. That is a licensing posture rather than a security one, and it is decided long before the vulnerability appears.

This article describes the attack surface and defensive mitigations for awareness purposes. No exploit code or proof-of-concept technical detail is reproduced here.