# Microsoft Exchange Zero-Day Under Active Attack—No Patch in Sight
## The Threat
Microsoft has disclosed a critical zero-day vulnerability in Exchange Server that's already being exploited in the wild, leaving administrators without a protective patch nearly a week after public disclosure. CVE-2026-42897 is a cross-site scripting (XSS) flaw in Outlook Web Access (OWA) that allows attackers to execute arbitrary JavaScript code in users' browsers when they interact with specially crafted emails.
The vulnerability's mechanics are straightforward but dangerous: an attacker sends a malicious email to a targeted user. When the victim opens that email in Outlook Web Access and meets certain interaction conditions, the attacker's JavaScript executes within the browser context of the authenticated OWA session. This execution context grants access to everything the victim's account can access—mailbox contents, session tokens, calendar information, and contact data.
What makes this zero-day particularly concerning is the breadth of potential impact. According to analysis from Belgium's Centre for Cybersecurity (CCB), successful exploitation doesn't just allow eavesdropping: attackers can steal session tokens for further lateral movement, modify mailbox settings to enable persistent access, and alter email content—enabling sophisticated phishing campaigns or business email compromise (BEC) attacks from within compromised accounts.
## Severity and Impact
| Field | Details |
|-----------|-----------|
| CVE ID | CVE-2026-42897 |
| Vulnerability Type | Stored Cross-Site Scripting (XSS) |
| CVSS v3.1 Score | 8.1 (Microsoft) / 6.1 (NIST NVD) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required (user opens email) |
| CWE | CWE-79 (Improper Neutralization of Input During Web Page Generation) |
| Status | Under Active Exploitation |
| CISA KEV Listed | Yes (as of May 17, 2026) |
The CVSS discrepancy between Microsoft's 8.1 and NIST's 6.1 reflects disagreement over impact severity—Microsoft's assessment assumes confidentiality and integrity breaches, while NIST's lower score may underweight the practical risk in an email context where user interaction is inevitable.
## Affected Products
The zero-day affects on-premise Microsoft Exchange Server installations:
Cloud-hosted Exchange Online and hybrid Exchange deployments require immediate investigation to determine exposure scope, though early reports suggest the vulnerability is specific to on-premise OWA implementations.
## Mitigations
Immediate Actions (Before Patching):
1. Monitor OWA Access: Log and review recent OWA authentication patterns, particularly failed or anomalous login attempts and cross-browser access from unusual geographic locations.
2. Email Gateway Filtering: Configure mail filtering rules to block emails with JavaScript content or suspicious HTML attributes (particularly onload, onerror, and event handlers). Many organizations can deploy temporary filters without major operational disruption.
3. Network Segmentation: If possible, restrict OWA access to known corporate IP ranges or VPNs to reduce the attack surface while exploits are being actively weaponized.
4. Disable OWA Temporarily: For organizations that can operate without webmail access for critical functions, temporarily disabling OWA is the strongest mitigation pending a patch.
5. Session Token Review: Audit and invalidate active Exchange sessions to terminate any potential lateral movement attempts by compromised accounts. Force re-authentication for all users.
6. Backup and Audit Trail: Verify that mailbox backup and audit logging are enabled and configured to capture changes to email rules, forwarding rules, and mailbox permissions.
Patch Planning:
## References
---
## HackWire Analysis
The gap between disclosure and available patches exposes a structural weakness in enterprise vulnerability management: XSS flaws, despite being common and well-understood, remain dangerous when they compromise high-value targets like email systems. CVE-2026-42897's severity lies not in novelty but in placement—an XSS in OWA is an XSS in the heart of an organization's communication infrastructure, where stolen session tokens can unlock entire mailboxes and where the attacker inherits the victim's email authority.
The CVSS scoring disagreement is telling. Microsoft's 8.1 reflects the real-world risk: confidentiality and integrity of email, potential account takeover, and lateral movement pathways. NIST's 6.1 suggests a more conservative interpretation, possibly undervaluing the interaction requirement. For incident responders, the practical lesson is to treat this as 8.1+—assume worst-case impact until proven otherwise.
Organizations running on-premise Exchange should note that the zero-day timeline matters. Disclosed on May 16, CISA listed it May 17, but patches have not shipped. Early adoption of email gateway filtering and OWA access restrictions can significantly reduce exploitation likelihood before patches arrive. The fact that attackers are already weaponizing this, just days after disclosure, underscores that defenders face an active threat, not a theoretical one.
This incident also highlights why email security remains foundational: no amount of perimeter defense or endpoint detection compensates for a compromised mailbox. If you haven't recently audited email rules, forwarding configurations, and mailbox delegation policies across your organization, CVE-2026-42897 is a forcing function to do so today.
— HackWire Editorial
---
## Related Coverage