CVE-2026-42897 — Microsoft Exchange Server Spoofing Vulnerability

Executive Summary

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Overview

6.1

CVSS MEDIUM

Critical

MS Severity

Exploited

MS Exploit Status

Exploitation Detected

MS Exploit Likelihood

Category Spoofing

Weakness CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Released May 12 2026

Last Updated May 12 2026

Publicly Disclosed No

CISA KEV Listed (added 2026-05-15)

Known Exploits None Known

EPSS Score 0.70307 — 0.99327 percentile

NVD CVSS 6.1 MEDIUM — differs from MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C

ATTACK VECTOR

Network

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

None

USER INTERACTION

Required

SCOPE

Changed

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

None

EXPLOIT CODE MATURITY

Functional

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 7.5

EPSS Score

0.70307

probability of exploitation in the next 30 days

0.99327 percentile - updated 2026-08-14

View on FIRST.org

Affected Products

4 affected products

Product	KB Article	Severity	Impact	Restart Required
Microsoft Exchange Server 2016 Cumulative Update 23	`5094144 (Security Update)`	Critical	Spoofing	Yes
Microsoft Exchange Server 2019 Cumulative Update 14	`5094142 (Security Update)`	Critical	Spoofing	Yes
Microsoft Exchange Server 2019 Cumulative Update 15	`5094140 (Security Update)`	Critical	Spoofing	Yes
Microsoft Exchange Server Subscription Edition RTM	`5094139 (Security Update)`	Critical	Spoofing	Yes

Patches

4 patches

Article	Type	Restart
`5094144`	Security Update	Yes
`5094142`	Security Update	Yes
`5094140`	Security Update	Yes
`5094139`	Security Update	Yes

Exploits & PoC

1 public PoC

Unverified third-party code

Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.

Repository	Stars	Published	Description
atiilla/CVE-2026-42897	5	2026-05-15	CVE-2026-42897 - Exchange Health Checker blind spot: outbound IIS URL Rewrite rules silently ignored, making EOMT mitigations invisible in diagnostic reports.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

Anonymous

References

MSRC Advisory MITRE NVD