Microsoft Exchange Zero-Day CVE-2026-42897 Actively Exploited — No Full Patch, Automatic Mitigation Only

Every on-premises Exchange deployment is a target right now. Microsoft confirmed active exploitation of CVE-2026-42897, an 8.1-rated cross-site scripting vulnerability in Outlook Web Access that requires zero interaction beyond a victim opening an email.

What the Vulnerability Does

The flaw lives in OWA’s mail rendering engine. An attacker sends a specially crafted email; when the recipient opens or previews it in OWA, arbitrary JavaScript executes inside the victim’s browser session. From there, an attacker can steal session cookies, pivot to internal systems reachable via the browser, forge requests as the authenticated user, or deliver follow-on payloads.

Microsoft disclosed CVE-2026-42897 on May 14, 2026. CISA added it to the Known Exploited Vulnerabilities catalog the following day, setting a federal remediation deadline of May 29, 2026.

Who Is Affected

• Exchange Server 2016 (all CU levels)
• Exchange Server 2019 (all CU levels)
• Exchange Server Subscription Edition (RTM and later)
• Exchange Online: NOT affected

If your organization migrated fully to Exchange Online, you have nothing to do. Any on-prem Exchange deployment — whether hybrid or standalone — is exposed.

There Is No Full Patch Yet

Microsoft has not released a security update that permanently addresses the root cause. Instead, the company deployed an automatic mitigation via the Exchange Emergency Mitigation Service (EEMS), using URL rewrite rules to block the crafted requests. The EEMS label is M2.1.x.

This mitigation applies automatically on Exchange servers where EEMS is enabled. Verify its status:

Get-ExchangeDiagnosticInfo -Server <ServerName> -Process EdgeTransport -Component ResourceThrottling -Settings MitigationService

If EEMS is disabled in your organization, apply the mitigation rules manually via the Exchange Admin Center before the May 29 deadline.

Additional Hardening Steps

Beyond verifying EEMS, security teams should:

1. Restrict OWA access to VPN or known IP ranges while waiting for a permanent patch.
2. Monitor Exchange logs for unusual JavaScript execution patterns in OWA request logs.
3. Test email gateway rules that strip or sandbox crafted HTML/script payloads before delivery.
4. Check hybrid connector trust — in hybrid deployments, verify that EEMS propagation reached all Exchange nodes, not just internet-facing servers.

Why This Matters Now

Exchange is a high-value target. Credential theft from a mail administrator session can unlock Active Directory. The active exploitation signal, combined with the complete absence of a permanent fix, means the window for compromise is open right now.

Organizations with hybrid Exchange setups should treat this as a weekend-severity incident, not a planned patching cycle. Microsoft has not disclosed the threat actors behind the exploitation or the estimated number of compromised organizations — which typically means the scale is still being assessed or the intelligence is classified.

A permanent patch is expected in the next monthly rollup, but “expected” is not “available.” Verify EEMS, restrict OWA, and watch your logs.