Microsoft this week patched 137 vulnerabilities with its Patch Tuesday updates, but on Thursday, May 14, the Exchange Server Zero Day (CVE-2026-42897) issue ended up described by Microsoft as a spoofing and cross-site scripting vulnerability affecting Exchange Server Subscription Edition, 2016, and 2019.
The vulnerability is in Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. Additionally, if the user opens the email in Outlook Web Access and certain interaction conditions end up met, arbitrary JavaScript can execute in the browser context.
The following on-premises Exchange Server versions suffer from the issue:
- Exchange Server 2016 (any update level)
- Exchange Server 2019 (any update level)
- Exchange Server Subscription Edition (SE) (any update level)
CVE 2026 42897 is the case number for the vulnerability which is an improper neutralization of input during web page generation. It has a CVSS v3.1 score of 8.1.
Meanwhile, there is improper neutralization of input during web page generation in Microsoft Exchange Server.This allows an unauthorized attacker to perform spoofing over a network, Microsoft said in its advisory.
Microsoft is working on and will release  a security update for impacted versions of Exchange Server in the future. An update will release for Exchange SE RTM, Exchange 2016 CU23, Exchange Server 2019 CU14 and CU15.
Until a permanent patch is developed, Microsoft released mitigation options.