CVE-2026-42897 in microsoft exchange server
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Affected software: microsoft exchange server, microsoft exchange server subscription edition
Scores
- CVSS: 6.1 (medium)
- EPSS: 70.66% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-05-15
- Published: 2026-05-14
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the latest Exchange Server security update and keep EEMS on (CVE-2026-42897, CVE-2023-21529)
Patch or upgrade. Exchange Server has an exploited XSS spoofing flaw and an older deserialization RCE. Installing the current Exchange security update and keeping the Emergency Mitigation Service on closes both.
Applies to: Exchange Server 2016, 2019 and Subscription Edition builds listed in the Microsoft Update Guide.
- Run the Exchange Health Checker script to see the build of each server.
- Install the latest Cumulative Update and Security Update listed in the Microsoft Update Guide for CVE-2026-42897 and CVE-2023-21529.
- Keep the Exchange Emergency Mitigation Service enabled (`Get-OrganizationConfig | fl MitigationsEnabled`).
- Do not publish OWA/ECP to the internet without pre-authentication where possible.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.