Microsoft Exchange Server CVE-2026-42897

Successful exploitation requires victim to interact with attacker-controlled content while accessing Exchange Server web interfaces. Specifically, victim must click a crafted malicious link (in email, instant message, or website) or view attacker-supplied input rendered by Exchange (such as malicious calendar invite, contact card, or email content processed through OWA). Victim must have active or recent session with Exchange web services for maximum impact (session cookie theft), though XSS can still achieve content spoofing and credential harvesting against unauthenticated users. Attack does not require any non-default Exchange configuration - vulnerable code exists in standard OWA and web interface deployments. Exploitation limited by same-origin policy (attacker's payload executes only in Exchange domain context) and user's browser XSS protections (modern browsers block some reflected XSS patterns, though stored XSS and DOM-based variants may bypass filters). Social engineering success rate limits practical exploitation - attackers must convincingly induce click behavior through phishing pretext.

CVSS base score 8.1 reflects high severity driven by network exploitability (AV:N), no authentication requirement (PR:N), and high confidentiality/integrity impact (C:H/I:H) - attacker can steal session tokens, credentials, or modify displayed content. User interaction requirement (UI:R) provides significant practical barrier: victim must click malicious link or view attacker-controlled content rendered by Exchange. Temporal score component E:F confirms functional exploit code exists, elevating real-world risk. However, no CISA KEV listing indicates no confirmed widespread or targeted exploitation campaigns as of analysis date. EPSS data not provided, but historical Exchange XSS vulnerabilities typically show moderate exploitation probability (15-35%) due to high target value but UI requirement. Attack is automatable for delivery (phishing emails) but not execution (requires user click). Technical impact enables credential theft and session hijacking against high-value email infrastructure - higher real-world consequence than CVSS availability rating (A:N) suggests. Remediation Level (RL:O) confirms official patch availability, reducing residual risk for patched systems. Priority classification: High for internet-facing OWA deployments and organizations targeted by phishing campaigns; Medium for internal-only Exchange with strong email security controls. Key uncertainty: precise affected component (OWA vs EAC vs API) not specified in available data - defenders should apply patches universally rather than attempt component-specific risk assessment.

Attacker crafts malicious URL containing JavaScript payload targeting Exchange Server's web interface, embedding it in phishing email to organization employees. Victim clicks link while authenticated to Outlook Web Access, causing Exchange to render attacker's script in security context of victim's session. Injected JavaScript exfiltrates session cookies and authentication tokens to attacker-controlled server, enabling account takeover and access to victim's email, contacts, and calendar without further user interaction.