CVE-2026-42897

What it actually does

This is a network-exploitable cross-site scripting flaw in Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition. A remote, unauthenticated attacker can supply crafted input that Exchange includes in a generated web page without sufficient output encoding or sanitization. If a user is induced to open the crafted Exchange URL or page, attacker-controlled JavaScript can execute in that user's browser in the security context of the Exchange web application. Successful exploitation can allow spoofed Exchange content, theft or misuse of session material, mailbox data access through the victim's authenticated session, and actions performed as the victim within the affected Exchange interface. The CVSS vector indicates low attack complexity, no attacker authentication requirement, required user interaction, and high confidentiality and integrity impact.

Why it matters to the business

Compromise of an Exchange web session can expose sensitive email, calendars, attachments, address books, and internal communications, and may let an attacker alter mailbox settings, create forwarding or inbox rules, or impersonate trusted users in follow-on phishing. Because Exchange is a high-value identity and communications platform, exploitation can rapidly affect executive communications, legal or financial data, incident response coordination, and trust in email. This vulnerability is listed in CISA KEV, has active exploitation reported in the wild, has a high EPSS score, and the KEV remediation deadline of 2026-05-29 has passed, so unremediated externally reachable Exchange systems should be treated as urgent exposure.

How an attack unfolds

An attacker identifies an exposed Microsoft Exchange web endpoint, typically OWA or ECP, and crafts a URL or request containing scriptable payload content in a parameter or page input that Exchange later reflects or embeds into an HTML response. The attacker then delivers the link through phishing, spoofed internal communications, search poisoning, ClickFix-style lures, FakeCaptcha pages, or another social-engineering path. When a victim opens the link while authenticated to Exchange, the malicious script runs under the Exchange origin in the victim's browser. From there, the attacker can present convincing spoofed UI, collect credentials or reauthentication prompts, access page content available to the victim, invoke Exchange actions with the victim's privileges, or stage follow-on malware delivery by instructing the user to run commands or download files. In campaigns using ClickFix or FakeCaptcha-style lures, the XSS may be one step in a broader chain that turns a trusted Exchange page into a launchpad for credential theft, payload download, or user-assisted execution.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for the affected Exchange Server or Exchange Server Subscription Edition version. No exact fixed build was provided in the input, so administrators should use the Microsoft Security Update Guide and Exchange build documentation to identify the correct cumulative update and security update for their installed release. Prioritize internet-facing Exchange servers and complete remediation immediately because this issue is in KEV, is actively exploited, and the CISA due date has passed. If immediate patching is not possible, reduce exposure by restricting OWA/ECP access to trusted networks or VPN, enforcing MFA and conditional access where applicable, placing Exchange behind a WAF with rules blocking script-bearing parameters, disabling unnecessary external access, and increasing monitoring. Mitigations should be treated as temporary; they do not replace installing the vendor fix.

How to confirm the fix worked

Confirm all affected Exchange servers are inventoried, including passive nodes, hybrid servers, disaster-recovery systems, and Subscription Edition deployments. Verify the installed Exchange build, cumulative update, and security update level against Microsoft's fixed-version guidance. Use Microsoft Exchange Health Checker or equivalent administrative validation to identify missing Exchange updates and unsupported builds. From an external perspective, confirm that OWA/ECP endpoints are either patched or access-restricted. Where safe and authorized, test the previously vulnerable input path with a harmless encoded XSS canary and confirm it is rendered inert rather than executed. Review WAF, proxy, and IIS logs after remediation to confirm exploit attempts are blocked or safely encoded, and ensure no temporary mitigations were removed before patching was completed.

Typical attack path

1. Find an internet-facing Microsoft Exchange Server or Exchange Server Subscription Edition deployment exposing web interfaces such as OWA or ECP.
2. Craft an Exchange URL or request containing encoded JavaScript or HTML that is not properly neutralized when Exchange generates the page.
3. Deliver the crafted link to a target through phishing, spoofed internal email, poisoned search results, ClickFix instructions, FakeCaptcha prompts, or another lure.
4. Wait for a user to open the link, ideally while already authenticated to Exchange.
5. Execute attacker-controlled script in the victim's browser under the Exchange web application origin.
6. Spoof trusted Exchange content, steal session-relevant data, read accessible mailbox content, or perform Exchange actions as the victim.
7. Use compromised mailbox access or spoofed messages for lateral phishing, mailbox-rule creation, data theft, or malware delivery.

How to detect it

To determine whether this was already exploited, review Exchange IIS logs, Exchange HttpProxy logs, WAF logs, reverse-proxy logs, secure web gateway logs, email gateway telemetry, browser telemetry, and EDR data. Focus on requests to OWA/ECP or other Exchange web paths containing encoded script tags, JavaScript URI schemes, HTML event handlers, iframe/object/embed tags, base64-encoded payloads, or unusual long parameters. Correlate suspicious Exchange requests with the victim user's mailbox activity and endpoint behavior within the following minutes to hours. Look for new or modified inbox rules, external forwarding, mailbox delegation changes, unusual OWA/ECP/EWS access from unfamiliar IP addresses, impossible travel, high-volume message access, or unexpected downloads. For ClickFix and FakeCaptcha-style activity, examine web history, clipboard/script execution, and process trees where a browser leads to mshta.exe, powershell.exe, cmd.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or installer execution. Review phishing reports and mail-flow logs for messages containing crafted Exchange URLs, shortened links redirecting to Exchange, or lures instructing users to verify identity, complete a CAPTCHA, fix browser issues, or paste commands. Because XSS exploitation may leave only web-request traces, absence of malware artifacts does not rule out session abuse; correlate application logs with mailbox audit and identity logs.

• <script
• %3cscript
• %3Cscript
• </script>
• %3c%2fscript
• %3C%2Fscript
• javascript:
• java%73cript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• onerror=
• onload=
• onclick=
• onmouseover=
• <iframe
• %3ciframe
• <svg
• %3csvg
• <img
• %3cimg
• document.cookie
• document.domain
• localStorage
• sessionStorage
• eval(
• atob(
• fromCharCode
• new Image()
• fetch(
• XMLHttpRequest
• /owa/
• /ecp/
• /owa/auth/
• /ecp/default.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa\
• C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp\
• C:\inetpub\logs\LogFiles\W3SVC
• FakeCaptcha
• ClickFix
• mshta.exe
• powershell.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe
• bitsadmin.exe

What your security team should do

• Treat unpatched internet-facing Exchange servers as a priority incident-risk item because exploitation is active in the wild and the KEV remediation deadline has passed.
• Patch all affected Exchange Server and Exchange Server Subscription Edition systems using Microsoft-supported cumulative and security updates; include standby, lab-connected, and hybrid systems.
• Temporarily restrict external OWA/ECP access to trusted sources or VPN until patching is complete.
• Search historical IIS, Exchange HttpProxy, WAF, proxy, EDR, and email-security logs for XSS payloads and ClickFix/FakeCaptcha-style lures targeting Exchange users.
• Hunt for post-exploitation mailbox activity, including suspicious inbox rules, external forwarding, unusual OWA/ECP/EWS access, new devices, and anomalous mailbox logons.
• Monitor endpoints for user-assisted execution patterns following Exchange web access, especially powershell.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, and curl.exe launched from browsers or Office applications.
• Deploy or tune WAF/SIEM detections for encoded script tags, JavaScript URI handlers, event-handler attributes, and HTML injection attempts against Exchange web paths.
• Prepare user-facing guidance warning against ClickFix, FakeCaptcha, and copy-paste command prompts that appear after clicking email or Exchange links.