What the vulnerability does
01Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-42897
HIGH
CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability
CVSS base score
8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
CISA mandated remediation
02CISA Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Key dates
03Disclosure timeline
May 14, 2026
CVE published
June 9, 2026
Record updated
External resources
04References
NVD — National Vulnerability Database
https://nvd.nist.gov/vuln/detail/CVE-2026-42897
CWE — Common Weakness Enumeration
https://cwe.mitre.org/data/definitions/79.html
CISA KEV Reference
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CV…
CISA KEV Reference
https://learn.microsoft.com/en-us/exchange/plan-and-deploy/pos…
CISA KEV Reference
https://nvd.nist.gov/vuln/detail/CVE-2026-42897
