Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server
A vulnerability affecting Microsoft Exchange Server could allow an attacker to cause cross-site scripting (XSS) execution in users' browsers.
Description
Technical context and vulnerability details
Microsoft Exchange Server is an email and collaboration solution developed by Microsoft, widely deployed in enterprise environments for managing emails, calendars and contacts. This solution is affected by a vulnerability labeled CVE-2026-42897 resulting from improper input validation when generating web pages in the Outlook Web Access (OWA) component. Exploitation of this vulnerability would allow an unauthenticated attacker, via sending a specially crafted email to a user who opens it in OWA, to execute arbitrary JavaScript scripts in the victim's browser, potentially leading to identity theft or email account compromise. It is classified high with a severity score of 8.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Running cross-site scripting (XSS) in the victim's browser;
- Impersonation of logged in user;
- Theft of session or sensitive data;
- Compromise of user's email account;
Affected systems
Products, components and targeted versions
- Exchange Server 2016 CU23;
- Exchange Server 2019 CU14 and CU15;
- Exchange Server SE RTM;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Enable the Exchange Emergency Mitigation Service (EM Service) to automatically apply mitigation published by Microsoft;
- Update Microsoft Exchange Server to patched versions as they become available;
- Check the status of mitigations applied via the Exchange Health Checker tool: [https://aka.ms/ExchangeHealthChecker] https://aka.ms/ExchangeHealthChecker;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.