INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers

| 2026-05-15 12:35 CRITICAL HIGH
JSON
Executive Summary AI-generated
The Microsoft Exchange Server vulnerability, CVE-2026-42897, is a high-severity zero-day flaw that allows an unauthorized attacker to perform spoofing over a network. This exploit was disclosed by the tech giant on May 14 and affects some on-premises Exchange Server versions: all existing Exchange Server 2016 versions, all existing Exchange Server 2019 versions, and all existing Exchange Server Subscription Edition (SE) versions. The vulnerability is due to an improper neutralization of input during web page generation - also called cross-site scripting (XSS) - in Microsoft Exchange Server that allows an attacker to perform spoofing over a network. Administrators can manually apply the mitigation by downloading the latest version of the Exchange On-premises Mitigation Tool (EOMT), running the provided PowerShell script, or both. However, this approach may cause issues such as disabling or disrupting features like OWA Print Calendar and Inline images. Microsoft has acknowledged that both mitigation measures can be problematic. The vulnerability is rated 8.1 on the CVSS scale, indicating its severity.
Technical Mitigations AI-generated
• Enable Exchange Emergency Mitigation (EM) Service • Manually apply the Exchange On-premises Mitigation Tool (EOMT) • Run PowerShell script targeting either a single server or all servers at once using CVE-2026-42897 identifier
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2023-21529CVE-2023-21529 CVE-2026-42897CVE-2026-42897
Target & Sectors
NORTH_AMERICA NORTH_AMERICA BENELUX BENELUX healthhealth
Incident Timeline
‎September 2021
Threat actors exploited a zero-day vulnerability in Microsoft Exchange EEMS introduced in September 2021.
‎older than March 2023
Administrators can verify the incident by checking the applied mitigations for CVE-2026-42897 (M2.1.x) through Microsoft Exchange Health Checker documentation or enabling EM Service on servers running older versions of Exchange Server.
industry Health
Administrators can verify this by: Checking the applied mitigations for CVE-2026-42897 (M2.1.x) through the documentation Running the Exchange Health Checker script to quickly check the status of EM Service and applied mitigations Enabling the EM Service if it is currently disabled, as Microsoft strongly recommends doing so Note that servers running versions older than March 2023 cannot receive new mitigations through this service.
organisation CVE-2026-42897
Administrators can verify this by: Checking the applied mitigations for CVE-2026-42897 (M2.1.x) through the documentation Running the Exchange Health Checker script to quickly check the status of EM Service and applied mitigations Enabling the EM Service if it is currently disabled, as Microsoft strongly recommends doing so Note that servers running versions older than March 2023 cannot receive new mitigations through this service.
organisation Running the Exchange Health Checker
Administrators can verify this by: Checking the applied mitigations for CVE-2026-42897 (M2.1.x) through the documentation Running the Exchange Health Checker script to quickly check the status of EM Service and applied mitigations Enabling the EM Service if it is currently disabled, as Microsoft strongly recommends doing so Note that servers running versions older than March 2023 cannot receive new mitigations through this service.
organisation EM Service
Administrators can verify this by: Checking the applied mitigations for CVE-2026-42897 (M2.1.x) through the documentation Running the Exchange Health Checker script to quickly check the status of EM Service and applied mitigations Enabling the EM Service if it is currently disabled, as Microsoft strongly recommends doing so Note that servers running versions older than March 2023 cannot receive new mitigations through this service.
organisation Enabling the EM Service
Administrators can verify this by: Checking the applied mitigations for CVE-2026-42897 (M2.1.x) through the documentation Running the Exchange Health Checker script to quickly check the status of EM Service and applied mitigations Enabling the EM Service if it is currently disabled, as Microsoft strongly recommends doing so Note that servers running versions older than March 2023 cannot receive new mitigations through this service.
tactic T1584.004 - Server
Please note that EM Service will not be able to check for new mitigations if your server is running Exchange Server version older than March 2023.
‎2026/05/11
Threat actors exploited a previously unknown vulnerability in Microsoft Exchange, specifically CVE-2026-42897, by targeting users through Outlook Web Access when certain interaction conditions were met.
vulnerability CVE-2026-42897
"If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context." CVE-2026-42897 was disclosed two days after a large Patch Tuesday release last week that, ironically, contained no zero-days.
organisation Outlook Web Access
"If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context." CVE-2026-42897 was disclosed two days after a large Patch Tuesday release last week that, ironically, contained no zero-days.
tactic T1059.007 - JavaScript
"If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context." CVE-2026-42897 was disclosed two days after a large Patch Tuesday release last week that, ironically, contained no zero-days.
‎May 14
Threat actors used a previously unknown vulnerability in Microsoft Exchange to target all versions of the software.
tactic T1584.004 - Server
This high-severity vulnerability (CVSS rating of 8.1), disclosed by the tech giant on May 14, is affecting some on-premises Exchange Server versions: All existing Exchange Server 2016 versions All existing Exchange Server 2019 versions All existing Exchange Server Subscription Edition (SE) versions It does not impact Exchange Online.
infrastructure 8.1
This high-severity vulnerability (CVSS rating of 8.1), disclosed by the tech giant on May 14, is affecting some on-premises Exchange Server versions: All existing Exchange Server 2016 versions All existing Exchange Server 2019 versions All existing Exchange Server Subscription Edition (SE) versions It does not impact Exchange Online.
organisation the Exchange Team
However, in a security advisory published on May 14 , the Exchange Team shared two approaches security teams can take to mitigate the impact of potential exploits of this vulnerability before patches are available.
‎2016, 2019
Threat actors exploited a previously unknown vulnerability in Microsoft Exchange Server 2016, 2019 and Service Editions instances to gain unauthorized access.
tactic T1584.004 - Server
The first, which Microsoft recommended, is for organizations that have the Exchange Emergency Mitigation (EM) Service, which received a mitigation for Exchange Server 2016, 2019, and SEs instances that is enabled automatically.
While patches aren't yet available to permanently fix the vulnerability, the company added that the Exchange Emergency Mitigation Service (EEMS) will provide automatic mitigation for Exchange Server 2016, 2019, and SE on-premises servers.
organisation the Exchange Emergency Mitigation
The first, which Microsoft recommended, is for organizations that have the Exchange Emergency Mitigation (EM) Service, which received a mitigation for Exchange Server 2016, 2019, and SEs instances that is enabled automatically.
organisation SEs
The first, which Microsoft recommended, is for organizations that have the Exchange Emergency Mitigation (EM) Service, which received a mitigation for Exchange Server 2016, 2019, and SEs instances that is enabled automatically.
organisation the Exchange Emergency Mitigation Service
While patches aren't yet available to permanently fix the vulnerability, the company added that the Exchange Emergency Mitigation Service (EEMS) will provide automatic mitigation for Exchange Server 2016, 2019, and SE on-premises servers.
‎May 15, 2026
Threat actors used a previously unknown vulnerability in Microsoft Exchange Server to target on-premise versions.
tactic T1584.004 - Server
 Ravie Lakshmanan  May 15, 2026 Microsoft / Vulnerability Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.
organisation Microsoft
 Ravie Lakshmanan  May 15, 2026 Microsoft / Vulnerability Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.
organisation Microsoft / Vulnerability
 Ravie Lakshmanan  May 15, 2026 Microsoft / Vulnerability Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild.
‎2026/05/15
Microsoft confirmed active exploitation of an Exchange Server zero-day vulnerability, CVE-2026-42897.
organisation Microsoft Exchange
The flaw, tracked as CVE-2026-42897, is due to an improper neutralization of input during web page generation – also called cross-site scripting (XSS) – in Microsoft Exchange Server that allows an unauthorized attacker to perform spoofing over a network.
"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network," the tech giant said in a Thursday advisory.
Microsoft Exchange Zero-Day Under Attack, No Patch Available.
The vulnerability is an improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange Server.
organisation Exchange
Administrators can manually apply the mitigation by: Downloading the latest version of the Exchange On-premises Mitigation Tool (EOMT) Running the provided PowerShell script from an elevated Exchange Management Shell, targeting either a single server or all servers at once using the CVE-2026-42897 identifier Microsoft acknowledged that both mitigation measures can cause issues, such as disabling or disrupting features (e.g. OWA Print Calendar, Inline images).
This week, Microsoft warned that threat actors are actively exploiting a new Exchange Server zero-day vulnerability tracked as  CVE-2026-42897 .
Microsoft confirms active exploitation of Exchange Server zero-day Microsoft warned that attackers are exploiting a new Exchange Server zero-day vulnerability, tracked as CVE-2026-42897, in the wild.
Microsoft on Thursday disclosed a zero-day vulnerability in Exchange that's under active exploitation, but four days later customers are still awaiting a patch.
Microsoft warns of Exchange zero-day flaw exploited in attacks.
If using the Exchange Emergency Mitigation Service is not an option due to air-gap restrictions, the company has outlined the following series of actions - Download the latest version of the Exchange on-premises Mitigation Tool (EOMT) from aka[.]ms/UnifiedEOMT.
organisation Exchange Management Shell
Administrators can manually apply the mitigation by: Downloading the latest version of the Exchange On-premises Mitigation Tool (EOMT) Running the provided PowerShell script from an elevated Exchange Management Shell, targeting either a single server or all servers at once using the CVE-2026-42897 identifier Microsoft acknowledged that both mitigation measures can cause issues, such as disabling or disrupting features (e.g. OWA Print Calendar, Inline images).
Apply the mitigation on a per-server basis or on all servers at once by running the script via an elevated Exchange Management Shell (EMS): Single server: .\EOMT.ps1 -CVE "CVE-2026-42897" All servers: Get-ExchangeServer | Where-Object { $_.ServerRole -ne
" The second mitigation option is an updated Exchange On-premises Mitigation Tool (EOMT), which Microsoft recommended customers download and apply either on a per-server basis or by executing the script through an elevated Exchange Management Shell (EMS).
Admins with servers in air-gapped environments can also mitigate the flaw by downloading the latest Exchange on-premises Mitigation Tool (EOMT) version and applying the mitigation by running the script via an elevated Exchange Management Shell (EMS) with one of the following commands:
organisation Cyber-Risks
South Korea Aims to Find Out Cyber-Risks to OWA Users CVE-2026-42897 affects the on-premise versions of Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).
organisation Exchange Outlook Web Access
The zero-day, tracked as CVE-2026-42897, affects Exchange Outlook Web Access (OWA) and enables an unauthorized attacker to execute spoofing attacks over a network.
organisation OWA
The zero-day, tracked as CVE-2026-42897, affects Exchange Outlook Web Access (OWA) and enables an unauthorized attacker to execute spoofing attacks over a network.
Microsoft warned that the Exchange Server zero-day affects Outlook Web Access (OWA).
Inline images might not display correctly in the recipients' OWA reading pane.
organisation Microsoft
This week, Microsoft warned that threat actors are actively exploiting a new Exchange Server zero-day vulnerability tracked as  CVE-2026-42897 .
CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-day.
Microsoft on Thursday disclosed a zero-day vulnerability in Exchange that's under active exploitation, but four days later customers are still awaiting a patch.
Microsoft warns of Exchange zero-day flaw exploited in attacks.
Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers.
organisation CVSS
Microsoft warned that threat actors are actively exploiting a new Exchange Server zero-day vulnerability tracked as CVE-2026-42897 (CVSS score 8.1).
Microsoft assigned the zero-day a CVSS score of 8.1, though the NIST's National Vulnerability Database assigned it a medium-severity 6.1 score.
organisation Crafted Email
On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email.
organisation EMS
Apply the mitigation on a per-server basis or on all servers at once by running the script via an elevated Exchange Management Shell (EMS): Single server: .\EOMT.ps1 -CVE "CVE-2026-42897" All servers: Get-ExchangeServer | Where-Object { $_.ServerRole -ne
" The second mitigation option is an updated Exchange On-premises Mitigation Tool (EOMT), which Microsoft recommended customers download and apply either on a per-server basis or by executing the script through an elevated Exchange Management Shell (EMS).
Admins with servers in air-gapped environments can also mitigate the flaw by downloading the latest Exchange on-premises Mitigation Tool (EOMT) version and applying the mitigation by running the script via an elevated Exchange Management Shell (EMS) with one of the following commands:
organisation EM Service
If you have EM Service currently disabled, we recommend you enable it right away," the software giant said.
If you have EM Service currently disabled, we recommend you enable it right away.
organisation Outlook Web Access
Microsoft warned that the Exchange Server zero-day affects Outlook Web Access (OWA).
If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context," the Exchange Team said .
Microsoft, which tagged the vulnerability with an "Exploitation Detected" assessment, said an attacker could weaponize it by sending a crafted email to a user, which, when opened in Outlook Web Access and subject to other "certain interaction conditions," can allow arbitrary JavaScript code to be executed in the context of the web browser.
infrastructure 19 Microsoft Exchange Server
Over the last 5 years, CISA has added 19 Microsoft Exchange Server vulnerabilities to its list of actively exploited security flaws, 14 of which were also abused in ransomware attacks.
organisation the Period 2 Exchange
Microsoft plans to release patches for Exchange SE RTM, Exchange 2016 CU23, and Exchange Server 2019 CU14 and CU15, but says that updates for Exchange 2016 and 2019 will only be available to customers enrolled in the Period 2 Exchange Server ESU program.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Microsoft Exchange Server)
organisation the Exchange Emergency Mitigation Service
If using the Exchange Emergency Mitigation Service is not an option due to air-gap restrictions, the company has outlined the following series of actions - Download the latest version of the Exchange on-premises Mitigation Tool (EOMT) from aka[.]ms/UnifiedEOMT.
The Exchange Emergency Mitigation Service will provide the mitigation automatically via a URL rewrite configuration, and is enabled by default.
organisation EOMT
" The second mitigation option is an updated Exchange On-premises Mitigation Tool (EOMT), which Microsoft recommended customers download and apply either on a per-server basis or by executing the script through an elevated Exchange Management Shell (EMS).
organisation On-Prem Exchange Servers
Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers.
organisation Outlook
Microsoft has warned of a high-severity zero-day vulnerability that could lead to an attacker sending arbitrary code to a victim by sending a specially crafted email to an Outlook user.
organisation Temporary Fixes Available
Temporary Fixes Available While Patch Is in Development Microsoft has not yet released a patch for this vulnerability.
organisation the Exchange Emergency Mitigation
The first option, which Microsoft recommends, uses the Exchange Emergency Mitigation (EM) Service.
organisation the EM Service
If the EM Service is enabled, which it is by default, the mitigation has already been automatically applied.
organisation the Centre for Cybersecurity Belgium
Microsoft did not provide details about the potential scope of cyberattacks, but in an advisory published on Monday, the Centre for Cybersecurity Belgium (CCB) warned that successful exploitation could give a threat actor access to a victim's Outlook mailbox and session tokens, and also allow them to make unauthorized changes to mailbox settings or modifications to email content.
organisation CCB
Microsoft did not provide details about the potential scope of cyberattacks, but in an advisory published on Monday, the Centre for Cybersecurity Belgium (CCB) warned that successful exploitation could give a threat actor access to a victim's Outlook mailbox and session tokens, and also allow them to make unauthorized changes to mailbox settings or modifications to email content.
organisation BEC
He warned that such mailbox compromises can lead to business email compromise (BEC) or ransomware attacks.
organisation Finally, Exchange
Finally, Exchange zero-days are frequently targeted in  cyber espionage campaigns  and  ransomware campaigns  because they provide high-value access with relatively low noise.
Finally, Exchange zero-days are frequently targeted in cyber espionage campaigns and ransomware campaigns because they provide high-value access with relatively low noise.
organisation Exchange Team
If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context," the Exchange Team said .
organisation NIST
Microsoft assigned the zero-day a CVSS score of 8.1, though the NIST's National Vulnerability Database assigned it a medium-severity 6.1 score.
organisation National Vulnerability Database
Microsoft assigned the zero-day a CVSS score of 8.1, though the NIST's National Vulnerability Database assigned it a medium-severity 6.1 score.
infrastructure Linux
Related: 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros Microsoft disclosed several issues caused by the mitigation, including disruptions to OWA Print Calendar and OWA light functionality, among other hiccups.
organisation OWA Print Calendar
Related: 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros Microsoft disclosed several issues caused by the mitigation, including disruptions to OWA Print Calendar and OWA light functionality, among other hiccups.
However, it’s important to note that applying the mitigation measures on vulnerable servers will cause issues, including: OWA Print Calendar functionality might not work.
organisation OWASP
According to Microsoft, the zero-day stems from a cross-site scripting (XSS) flaw , which is one of the most common software vulnerabilities found by security researchers, frequently making the Open Web Application Security Project's (OWASP) Top 10 lists.
organisation Fortbridge
In a LinkedIn post , Bogdan Tiron, founder of penetration testing firm Fortbridge, emphasized the impact "isn't server compromise.
organisation Maximum Severity
Related: Maximum Severity Cisco SD-WAN Bug Exploited in the Wild Mitigating the Microsoft Exchange Zero-Day In a blog post , Microsoft provided two mitigations options that customers can apply while they wait for a patch to arrive.
organisation the Microsoft Exchange
Related: Maximum Severity Cisco SD-WAN Bug Exploited in the Wild Mitigating the Microsoft Exchange Zero-Day In a blog post , Microsoft provided two mitigations options that customers can apply while they wait for a patch to arrive.
organisation the Exchange EM Service
Microsoft noted that the Exchange EM Service was released in 2021 and is enabled by default.
organisation EM
It's unclear what percentage of Exchange customers currently have the EM service enabled.
infrastructure Windows
EEMS runs as a Windows service on Exchange Mailbox servers and is automatically enabled on servers with the Mailbox role.
It's not on, users are advised to enable the Windows service.
organisation Mailbox
EEMS runs as a Windows service on Exchange Mailbox servers and is automatically enabled on servers with the Mailbox role.
organisation ProxyLogon
The security feature was added after many hacking groups exploited ProxyLogon and ProxyShell zero-days (which lacked patches or mitigation information) to breach Internet-exposed Exchange servers.
organisation ProxyShell
The security feature was added after many hacking groups exploited ProxyLogon and ProxyShell zero-days (which lacked patches or mitigation information) to breach Internet-exposed Exchange servers.
organisation the Outlook Desktop
As a workaround, Microsoft suggested copying the data, taking a screenshot of the calendar you want to print, or using the Outlook Desktop client.
organisation BleepingComputer
BleepingComputer also reached out to Microsoft with questions about the attacks, but a response was not immediately available.
organisation Exchange Emergency Mitigation Service
Redmond also noted that it's providing a temporary mitigation through its Exchange Emergency Mitigation Service , while it's readying a permanent fix for the security defect.
‎May 29, 2026
Threat actors exploited a recently disclosed Microsoft Exchange zero-day vulnerability.
‎May 2026
Threat actors exploited a previously unknown Microsoft Exchange zero-day vulnerability that surfaced two days after the company's May 2026 Patch Tuesday updates.
general_metric 138 vulnerabilities
The flaw surfaced just two days after  Microsoft’s Patch Tuesday for May 2026  updates, which patched 138 vulnerabilities.
The flaw surfaced just two days after Microsoft’s Patch Tuesday for May 2026 updates, which patched 138 vulnerabilities.
Tactical Metrics
Metrics
infrastructure
‎8.1
Software Version
This high-severity vulnerability (CVSS rating of 8.1), disclosed by the tech giant on May 14, is affecting some on-premises Exchange Server versions: All existing Exchange Server 2016 versions All existing Exchange Server 2019 versions All existing Exchange Server Subscription Edition (SE) versions It does not impact Exchange Online.
Metrics
infrastructure
‎Linux
Affected Product
Related: 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros Microsoft disclosed several issues caused by the mitigation, including disruptions to OWA Print Calendar and OWA light functionality, among other hiccups.
Metrics
infrastructure
19
Microsoft Exchange Server
Over the last 5 years, CISA has added 19 Microsoft Exchange Server vulnerabilities to its list of actively exploited security flaws, 14 of which were also abused in ransomware attacks.
Metrics
infrastructure
‎Windows
Affected Product
EEMS runs as a Windows service on Exchange Mailbox servers and is automatically enabled on servers with the Mailbox role.
It's not on, users are advised to enable the Windows service.
Intelligence Sources
The Hacker News 2026-05-15
BleepingComputer 2026-05-15
Infosecurity-Magazine 2026-05-15
Security Affairs 2026-05-15
Security Affairs 2026-05-16
Dark Reading 2026-05-18
Infosecurity-Magazine 2026-05-15