CVE-2026-42897highunder attackCWE-79

CVE-2026-42897: high-severity vulnerability in Microsoft Exchange Server 2016 Cumulative…

Microsoft Exchange Server Spoofing Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Exchange Server+ Monitor Microsoft.OpenApi.Kiota.Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 8.1epss 71%
from disclosure to weapon1 day
Published on NVDMay 14
1st PoC+1d
CISA KEV+1d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-05-29

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Exchange Server doesn't properly clean user input on web pages, allowing attackers to inject malicious code that can trick users into believing fake messages or actions. This is dangerous because attackers can impersonate legitimate communications to steal credentials or spread misinformation.

Technical detail

A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server's web interface fails to sanitize user-controlled input during page generation, enabling attackers to inject arbitrary scripts executed in victims' browsers. This vulnerability can be exploited over a network to perform spoofing attacks, compromising authentication integrity and session management.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Affected products
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23Microsoft · Microsoft Exchange Server 2019 Cumulative Update 14Microsoft · Microsoft Exchange Server 2019 Cumulative Update 15Microsoft · Microsoft Exchange Server Subscription Edition RTM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Exchange Server 2016 Cumulative…

In the same product, most dangerous first.

CVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-41040HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2022-41080HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 77.3%KEVCVE-2023-21529HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 59.3%KEVCVE-2024-21410CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 12.7%KEVCVE-2023-36035HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 86.6%