Search/CVE-2026-42897
● CVE — High

CVE-2026-42897

VendormicrosoftProductexchange server, exchange server subscription editionDiscoveredMay 14, 2026UpdatedOct 26, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

View graph Watch Export
CVSS v3.1
8.1 HIGH
EPSS
70.7%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
7
sources referencing this CVE
Related IOCs
3
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.36pp
70.3% → 70.7% over 5 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Connections
11 relationships
Timeline
disclosure → media coverage
May 14, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026
May 15, 2026
thehackernews.com reports: On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email
May 15, 2026
helpnetsecurity.com reports: Unpatched Microsoft Exchange Server vulnerability exploited (CVE-2026-42897)
May 15, 2026
acn.gov.it reports: Microsoft: rilevato sfruttamento attivo della CVE-2026-41615
May 15, 2026
securityweek.com reports: Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
May 18, 2026
darkreading.com reports: Microsoft Exchange Zero-Day Under Attack, No Patch Available
Jun 11, 2026
securityweek.com reports: Microsoft Patches Exploited Exchange Server Vulnerability
Sep 16, 2026
thehackernews.com reports: Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Public PoC (1)
github.com/atiilla/CVE-2026-42897
Unverified third-party code — review before executing.