# Microsoft Exchange Server Under Active Attack: Critical Spoofing Vulnerability Gives Attackers Email Access


## The Threat


Microsoft has disclosed a critical vulnerability affecting on-premises Exchange Server deployments that is already being exploited in active attacks. Tracked as CVE-2026-42897, the flaw stems from an improper input validation issue leading to cross-site scripting (XSS) that can be weaponized to spoof email messages and deceive users. While Microsoft has not yet disclosed specific attack vector details, the fact that exploitation is occurring in the wild indicates that attackers have discovered practical methods to leverage this vulnerability against real-world targets.


For organizations running on-premises Exchange infrastructure, this vulnerability represents an immediate threat to email security and user trust. Spoofing attacks that exploit XSS conditions can allow attackers to forge email messages that appear to come from trusted internal users or external contacts, potentially leading to phishing campaigns, credential harvesting, or distribution of malware. The vulnerability requires user interaction (such as clicking a malicious link within an email), but given the social engineering potential of spoofed emails from seemingly trusted sources, this barrier is relatively low.


Microsoft has responded by providing temporary mitigations through its Exchange Emergency Mitigation Service while engineering a permanent patch. However, the active exploitation timeline means defenders cannot wait for a complete fix—immediate action is required to reduce attack surface and limit exposure. Organizations are currently in a race against attackers to patch vulnerable systems before adversaries can establish persistent footholds in critical email infrastructure.


## Severity and Impact


| Aspect | Details |

|--------|---------|

| CVE Identifier | CVE-2026-42897 |

| CVSS Score | 8.1 (High) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |

| Attack Complexity | Low |

| Authentication Required | No |

| User Interaction | Yes (user must interact with malicious input) |

| CWE | CWE-79 (Cross-site Scripting) |

| Exploitation Status | Active exploitation confirmed |


## Affected Products


Microsoft Exchange Server on-premises deployments remain vulnerable, though Microsoft has not publicly specified which versions are affected. Organizations should assume all supported and near-end-of-support Exchange Server versions are at risk:


  • Microsoft Exchange Server 2019 (all cumulative updates)
  • Microsoft Exchange Server 2016 (all cumulative updates)
  • Microsoft Exchange Server 2013 (all cumulative updates)

    • Organizations running unsupported Exchange Server versions should prioritize immediate patching or migration plans, as these systems receive no security updates.


    ## Mitigations


    Immediate Actions:


  • Apply Exchange Emergency Mitigation Service (EMS): Microsoft has released emergency mitigations available through its EMS tool. Deploy these temporary fixes immediately to reduce attack surface while awaiting the permanent security update.

  • Restrict Exchange Access: Limit access to Exchange Server to trusted networks only. Use network segmentation and firewall rules to restrict traffic to the servers, particularly OWA (Outlook Web Access) and ECP (Exchange Control Panel) endpoints.

  • Disable Unnecessary Services: Disable any non-essential Exchange services and features not required for business operations. This reduces the available attack surface.

  • Monitor for Suspicious Activity: Implement aggressive logging and monitoring of Exchange servers for signs of exploitation, including unusual email forwarding rules, suspicious calendar modifications, and anomalous administrative activity.

  • User Education: Advise users to be cautious when clicking links in email, even from apparently internal senders, until the vulnerability is fully patched. Implement email authentication (SPF, DKIM, DMARC) to help prevent spoofing.

    • Long-term Solutions:


  • Apply Security Updates: Apply the permanent security update from Microsoft as soon as it becomes available and is tested in your environment.

  • Plan for Modern Exchange: Consider migration to Exchange Online (Microsoft 365) or hybrid deployments that reduce the attack surface of on-premises infrastructure.

    • ## References


  • [Microsoft Security Advisory CVE-2026-42897](https://msrc.microsoft.com)
  • [Microsoft Exchange Emergency Mitigation Service Documentation](https://support.microsoft.com/en-us/help/4040348)
  • [CISA Alert: Exchange Server Exploited in the Wild](https://cisa.gov)

    • ---


    ## HackWire Analysis


    This vulnerability arrives amid an accelerating pattern of on-premises Exchange Server attacks that show no signs of slowing. The XSS-to-spoofing attack chain highlights a critical blind spot in email security: defenders often focus on preventing unauthorized *access* to Exchange while overlooking threats that abuse the *trust relationships* already established within email systems. A spoofed email from an internal account carries weight that no external phishing campaign can match.


    What makes CVE-2026-42897 particularly dangerous is its timing. This week also saw critical authentication bypasses in Cisco SD-WAN controllers (CVE-2026-20182) being actively exploited by the nation-state actor UAT-8616, plus a massive supply chain poisoning campaign across npm packages orchestrated by TeamPCP. The pattern is unmistakable: defenders are facing a multi-front assault where vulnerability discovery is outpacing patch cycles, and attackers are simultaneously compromising development tools and infrastructure that organizations depend on.


    The real danger here isn't just the Exchange bug itself—it's the cascade effect. Once an attacker spoofs an email from a trusted internal user to request credentials, reset MFA, or update payment information, the email's legitimacy becomes the primary defense. With Exchange fully compromised, that legitimacy can be forged at will. Organizations betting on patching quickly need to understand that every hour an unpatched server remains exposed is an hour adversaries can establish persistence, harvest credentials, and position for lateral movement into cloud environments.


    For defenders, this should trigger an immediate reassessment of email server criticality: Is your on-premises Exchange instance truly necessary, or is it a legacy liability? If it must stay, the calculus has changed—temporary mitigations are no longer optional suggestions. The permanent fix cannot come soon enough, but it won't matter if you're still running Exchange on an unmanaged, exposed network segment.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)