Cross-site scripting in Microsoft Exchange Server (CVE-2026-42897) — arbitrary JavaScript execution in OWA
Microsoft Exchange Server, a mail server, has a cross-site scripting (XSS) vulnerability where, during web page generation in Outlook Web Access (OWA) and under certain interaction conditions, arbitrary JavaScript can be executed in the browser context. CISA listed it as known-exploited (KEV) (CVSS 8.1 High).
Key facts
- CVE IDCVE-2026-42897
- CVSS base score8.1 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Affected (vendor / product)Microsoft Microsoft
- CWECWE-79
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-05-29 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Cross-site scripting (CWE-79) in Microsoft Exchange Server's Outlook Web Access (OWA)
- Under certain conditions, arbitrary JavaScript can run in the browser context
- Can lead to session hijacking, email theft, and impersonation
- Exchange is a high-value asset (e.g. past ProxyLogon). Listed in CISA KEV (CVSS 8.1 High)
- Response: apply Microsoft security updates; prioritize internet-exposed OWA
- XSS does not take the server, but succeeding in OWA it leads to session hijacking and theft of mail content.
1The Exchange Server flaw
CVE-2026-42897 is a cross-site scripting vulnerability (CWE-79: XSS) in Microsoft Exchange Server (a mail-server product widely used as enterprise email infrastructure). It was added to CISA's KEV catalog on May 15, 2026.
2What happens in the OWA web interface
Per NVD, during web page generation in Outlook Web Access (OWA), when certain interaction conditions are met, arbitrary JavaScript can be executed in the victim's browser context. OWA is the entry point for using email from a browser; script execution there can lead to session hijacking, theft of email content, and impersonation.
3The lineage since ProxyLogon
Exchange Server has a history of severe vulnerabilities (such as ProxyLogon) being widely exploited, making it a high-value asset that attackers favor. While XSS by itself does not always lead to full server compromise, email infrastructure is a highly confidential target, and the KEV listing pushes for prompt action.
4The harm lands in the user's browser
XSS is not the class of vulnerability that takes the server itself. Succeeding on a mail platform, though, the nature of the information handled makes it heavy.
- 1An OWA web page is generatedOWA is the entrance for using mail from a browser
- 2Certain interaction conditions are metCrafted content is reflected into the page
- 3It executes in the victim's browserArbitrary JavaScript runs in the victim's context
- 4Sessions and content are takenSession hijacking, theft of mail content and impersonation follow
Exchange Server has seen serious vulnerabilities widely exploited before, ProxyLogon among them, making it a high-value asset attackers watch. XSS does not always lead directly to compromise of the whole server, but the target is a mail platform holding confidential material, and that is what gives the KEV listing its weight. Where OWA is exposed externally the priority rises.
Why it matters
A vulnerability in the widely used Exchange email infrastructure that directly enables attacks via webmail (OWA). Organizations running Exchange should prioritize prompt application of cumulative security updates and review OWA exposure. It shows continued attacks on high-value assets.
FAQ
What is XSS (cross-site scripting)?
What is OWA?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).