# Microsoft Exchange Zero-Day Under Active Exploitation; Patches Remain Unavailable
Microsoft has disclosed a high-severity cross-site scripting vulnerability affecting its Exchange Server platform that is already being weaponized by threat actors in the wild. The flaw, tracked as CVE-2026-42897, permits attackers to inject malicious JavaScript into the Outlook Web Access interface, potentially leading to arbitrary code execution on victim systems. With permanent patches still weeks away, the company is relying on automated defenses and interim mitigation tools to protect vulnerable organizations.
## The Threat
The vulnerability manifests as a spoofing flaw within the mail platform's web interface, specifically targeting users who access their messages through Outlook on the web. An attacker exploits the weakness by crafting a specially designed email message and delivering it to a target recipient. When the victim opens the message in their browser and meets certain interaction requirements, the malicious script executes within the security context of their web browser, granting the attacker significant control over the user's session.
The flaw affects three widely deployed versions of Exchange:
Evidence indicates that exploitation is already occurring in targeted campaigns, though Microsoft has not yet disclosed the scope or identity of affected organizations.
## Technical Details
The vulnerability operates as a client-side attack vector that depends on the victim's browser as the execution environment. Unlike server-side flaws that can be remotely exploited without user interaction, this XSS variant requires a user to open a malicious email message in Outlook Web Access and perform some action that triggers the malicious code. Once the JavaScript executes, the attacker operates with the same privileges as the authenticated user—potentially exfiltrating messages, accessing shared resources, or pivoting to other systems on the organization's network.
The spoofing classification suggests the flaw may also involve visual or identity deception, allowing attackers to make malicious messages appear to originate from trusted senders or to mask their true intent. This social engineering dimension increases the likelihood of user interaction and successful exploitation.
## Background and Context
The emergence of this vulnerability comes as Microsoft's mail platform has faced increasing scrutiny following major exploitation campaigns in recent years. The ProxyLogon and ProxyShell zero-day incidents—which allowed attackers to remotely compromise internet-exposed Exchange servers with minimal friction—prompted Microsoft to introduce the Exchange Emergency Mitigation Service (EEMS) in September 2021.
EEMS operates as an autonomous Windows service deployed on Exchange Mailbox servers, continuously monitoring for indicators of active exploitation and automatically applying interim protections while patches are developed. The service was designed specifically to prevent a repetition of the ProxyLogon scenario, where critical flaws went unpatched for extended periods while attackers systematically compromised thousands of on-premises installations.
By default, EEMS is enabled on all Exchange servers with the Mailbox role. However, organizations that previously disabled the service for operational reasons will need to re-enable it manually to benefit from automatic protections.
## Mitigation Options
### Automated Protection via EEMS
Microsoft's preferred mitigation path leverages EEMS to protect vulnerable servers without requiring manual intervention. Organizations using current Exchange versions should verify that the service is active and configured to receive mitigation updates from Microsoft's infrastructure.
The service requires Exchange Server versions released after March 2023 to function properly. Administrators running older deployments will be unable to receive new mitigations through this channel.
### Manual Mitigation for Isolated Networks
Organizations operating air-gapped or isolated Exchange infrastructure can apply protections using the Exchange On-Premises Mitigation Tool (EOMT). The tool runs as a PowerShell script within an elevated Exchange Management Shell and applies the required security modifications.
For a single server:
.\EOMT.ps1 -CVE "CVE-2026-42897"To apply mitigations across all eligible servers:
Get-ExchangeServer | Where-Object { $_.ServerRole -ne "Edge" } | .\EOMT.ps1 -CVE "CVE-2026-42897"### Operational Trade-Offs
Applying either mitigation introduces temporary functionality limitations that organizations should understand before deployment:
| Affected Feature | Impact | Workaround |
|---|---|---|
| Calendar Printing | OWA print function disabled | Manually copy calendar data or capture screenshots; use Outlook Desktop client |
| Inline Images | Images fail to render in reading pane | Send images as attachments; use Outlook Desktop client |
| OWA Light Interface | Legacy light version becomes unusable | Use standard OWA or desktop Outlook |
These limitations are intentionally strict because they represent the security trade-off necessary to block the exploitation vector while permanent fixes are developed.
## The Patching Timeline
Microsoft commits to releasing permanent patches but has implemented a tiered distribution model. Updates will target three specific versions:
Critically, patches for Exchange 2016 and 2019 will only be made available to customers enrolled in the Period 2 Exchange Server Extended Support Update (ESU) program. Organizations running unsupported versions without an ESU agreement will remain vulnerable indefinitely, with no permanent fix forthcoming. This creates a significant upgrade incentive for enterprises still operating legacy Exchange infrastructure.
## Implications for Enterprise Operations
The vulnerability exposes a fundamental tension in enterprise security: the balance between patching cycles and threat exposure. Exchange Server 2019 reached end-of-support status in October 2024, yet thousands of organizations worldwide continue to operate it in production environments. These deployments now occupy a precarious security position—unable to receive official patches without costly ESU contracts, forced to rely on interim mitigations that degrade user functionality.
Organizations running Exchange Server 2016 face a similar calculus. While still in extended support, the version is rapidly aging, and the pressure to migrate to newer platforms or to cloud-based alternatives is intensifying.
## Recommendations
Immediate actions for all organizations:
1. Verify EEMS status on all Exchange servers with the Mailbox role; enable the service if currently disabled
2. Assess patch readiness by determining which Exchange versions are deployed and whether ESU coverage exists
3. Test mitigation impact in a non-production environment to understand the effect on user-facing functionality
4. Consider upgrade timelines for systems older than Exchange 2019, prioritizing those with high-risk user populations (executives, finance, legal)
5. Implement detection controls to identify suspicious scripts or unusual activity patterns within OWA logs
## HackWire Analysis
This incident underscores the growing cost of legacy Exchange infrastructure. While EEMS and EOMT provide meaningful interim protections, they represent damage control rather than resolution. Microsoft's decision to restrict permanent patches to ESU customers effectively forces organizations into an upgrade decision masquerading as a security update—a pattern becoming familiar across the software industry. The real vulnerability here may be organizational: enterprises that deferred modernization decisions in prior years now face active exploitation with limited remediation options. The question is no longer whether to upgrade Exchange, but how quickly your organization can execute that transition before the next zero-day lands.