What is the CVSS score of CVE-2026-42897?

CVE-2026-42897 has a contested CVSS base score of 6.1 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Microsoft Exchange Server are affected by CVE-2026-42897?

CVE-2026-42897 is a high-severity cross-site scripting vulnerability in Microsoft Exchange Server that allows unauthenticated remote attackers to steal credentials and spoof content, directly…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42897?

Yes, a public proof-of-concept exploit is available for CVE-2026-42897. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-42897?

Within 24 hours: Identify all Microsoft Exchange Server instances (2016 CU23, 2019 CU14/CU15, and Subscription Edition) and document web-facing deployments. Within 7 days: Apply vendor-released patch from Microsoft MSRC security update guide to all affected servers; prioritize systems with external OWA/webmail access. Within 30 days: Verify patch deployment across all instances via update management tooling; conduct post-patch vulnerability scan to confirm remediation.

Microsoft Exchange Server CVE-2026-42897

EUVD-2026-30343 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 microsoft

GHSA-3c39-338m-m4vp

XSS Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 14 Microsoft Exchange Server 2019 Cumulative Update 15 Microsoft Exchange Server Subscription Edition Rtm

Medium

Disputed · 6.1 NVD

Temporal: 7.5

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

7.5 HIGH

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jun 15, 2026 - 19:22 NVD

8.1 (HIGH) 6.1 (MEDIUM)

Added to CISA KEV

May 15, 2026 - 18:02 CISA

Analysis Generated

May 14, 2026 - 17:45 vuln.today

CVE Published

May 14, 2026 - 17:00 nvd

HIGH 8.1

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Articles & Coverage 1

POC CVE-2026-42897: Exchange Health Checker Misses Outbound IIS Rewrite Rules, Hiding EOMT Mitigation Status May 15, 2026

AnalysisAI

Cross-site scripting (XSS) in Microsoft Exchange Server enables remote attackers to spoof content and steal credentials without authentication. Affects Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition. Functional exploit code exists (CVSS temporal E:F) though no active exploitation confirmed at analysis time. CVSS 8.1 (High) driven by network vector, no authentication requirement, and dual confidentiality/integrity impact. Microsoft released patches via MSRC security update guide. Medium-high priority for organizations running affected Exchange versions with webmail or OWA exposed.

Technical ContextAI

CWE-79 cross-site scripting vulnerability in Microsoft Exchange Server's web interface components, likely affecting Outlook Web Access (OWA) or Exchange Admin Center (EAC) input validation routines. Affected products span Exchange Server 2016 CU23 (on-premises), Exchange Server 2019 CU14 and CU15 (on-premises), and Exchange Server Subscription Edition RTM (cloud-connected hybrid deployments). XSS flaws in Exchange typically manifest in email rendering engines, calendar invite handlers, or administrative web panel input fields where user-supplied data is reflected in generated HTML/JavaScript without proper encoding. Exchange Server's ASP.NET-based web stack requires multi-layer sanitization across C

backend code and client-side JavaScript - failures at any layer enable script injection. The network attack vector (AV:N) with low complexity (AC:L) indicates exploitation through standard HTTP/HTTPS traffic to Exchange web services, requiring no special network positioning beyond internet or intranet access to the Exchange server's web interfaces.

RemediationAI

Apply security updates released by Microsoft via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897, which provides cumulative update packages addressing this XSS vulnerability across all affected Exchange Server versions. Exchange patches are cumulative - install the latest CU for your major version to receive the fix (likely CU24+ for Exchange 2016, CU16+ for Exchange 2019 based on affected CU listings). Interim mitigations before patching: implement Content Security Policy (CSP) headers on Exchange web virtual directories to restrict inline script execution (trade-off: may break custom OWA add-ins or poorly coded third-party integrations); deploy email security gateway with URL rewriting to proxy external links through sandbox environments (reduces phishing vector effectiveness but adds latency); restrict OWA access to VPN-authenticated users only if feasible for your organization (eliminates unauthenticated external attack surface but impacts user experience for remote workers). For Subscription Edition, Microsoft may auto-apply patches - verify deployment status through Microsoft 365 admin center. Test patches in non-production environment first as Exchange CUs can affect mailbox database schema and require extended maintenance windows.