What Happened
On May 14, 2026, Microsoft disclosed CVE-2026-42897, a reflected cross-site scripting (XSS) vulnerability in the Outlook Web Access (OWA) component of on-premises Microsoft Exchange Server. The flaw is already being actively exploited in the wild — attackers are sending specially crafted emails that execute arbitrary JavaScript in the victim's browser context the moment the email is opened in OWA. No clicks on links or attachments required. BleepingComputer confirmed Microsoft explicitly warned customers that real-world attacks are underway.
Technical Analysis
CVE-2026-42897 carries a CVSS score of 8.1 (High) and is classified as a spoofing vulnerability. The root cause is improper neutralization of user-supplied input during web page generation in OWA. An unauthenticated attacker crafts a malicious email containing embedded script payloads. When the recipient opens that email through the OWA interface, the script executes within the security context of the user's Exchange session. According to CVE Reports, this allows the attacker to perform actions on behalf of the authenticated user — including reading emails, modifying mailbox rules, and potentially exfiltrating credentials or session tokens. The attack surface is strictly on-premises: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) are confirmed affected. Cloud-hosted Microsoft 365 / Exchange Online environments are not impacted.
Who's Affected
Every organization running on-premises Exchange Server 2016, 2019, or SE with OWA enabled is in scope. Despite years of Microsoft pushing customers toward Exchange Online, hundreds of thousands of organizations — including governments, hospitals, financial institutions, and mid-size enterprises — still rely on on-prem Exchange. The 2021 Hafnium attacks on ProxyLogon (CVE-2021-26855) proved that on-prem Exchange remains a high-value target. CVE-2026-42897 follows the same pattern: attackers know these servers sit inside corporate networks, often with delayed patching cycles and direct access to sensitive email data. If your organization runs on-prem Exchange and hasn't patched yet, assume you are a target.
How to Protect Yourself
1. Patch immediately. Microsoft released the fix in the May 2026 Patch Tuesday update. Apply the security update to all Exchange Server 2016, 2019, and SE instances without delay. This is the single most effective action.
2. Restrict OWA access. If patching cannot happen within 24 hours, restrict OWA access to known IP ranges via firewall rules or conditional access policies. Reducing the attack surface buys time.
3. Audit mailbox rules. Attackers who successfully exploit XSS in OWA often create forwarding rules to exfiltrate emails. Check for suspicious inbox rules on high-value accounts (executives, IT admins, finance).
4. Enable MFA on all Exchange accounts. While MFA doesn't prevent the XSS execution itself, it limits the attacker's ability to reuse stolen credentials from other vectors.
5. Monitor OWA logs for anomalies. Look for unusual script execution patterns, unexpected POST requests from OWA sessions, or logins from new geolocations following email opens.
The Sable Angle
On-prem Exchange servers are a recurring blind spot in enterprise security. They sit behind the perimeter, often excluded from cloud-first security tooling, and they process the most sensitive communication in any organization. At Sable, our offensive security team routinely finds Exchange OWA exposed during external assessments — sometimes with known CVEs unpatched for months. The pattern is always the same: the server was deployed years ago, the team assumes it's "internal and safe," and no one is actively monitoring it.
This is exactly the kind of vulnerability that our research team flags during red team engagements. A single crafted email to an executive's OWA mailbox can become the entry point for full domain compromise — mailbox exfiltration, lateral movement via stored credentials, and persistence through hidden forwarding rules. If you're running on-prem Exchange, now is the time to audit your exposure, not after the next breach report hits the news.