CVE-2026-42897: exploited XSS flaw in Exchange OWA

CVE-2026-42897 is a cross-site scripting vulnerability in Outlook Web Access on on-premises Microsoft Exchange. An attacker can send a crafted message and execute JavaScript in the user’s browser context after it is opened in affected OWA.

Precision matters: this is not unauthenticated server-side RCE and not a zero-click flaw. It requires a message and opening it in OWA, but the TA488 campaign disclosed in late July demonstrated a half-click variant with no link or attachment action. The risk is confirmed: Microsoft reported exploitation and CISA added the issue to KEV.

30 July update: our OWAReaper and CVE-2026-42897 analysis covers mailbox permissions, tokens and multi-layer persistence.

Confirmed attack scenario

The Microsoft Exchange team described a crafted email opened in Outlook Web Access. Later Proofpoint analysis confirmed a campaign in which rendering the message triggered execution without clicking a link or opening an attachment.

The code runs in the user’s web session, not automatically as operating-system code on the Exchange server. XSS can still abuse trust in the mail interface and perform actions available within that session.

Affected environments

• Exchange Server 2016 before the security update;
• Exchange Server 2019 before the security update;
• Exchange Server Subscription Edition before the security update.

Exchange Online is not affected. Hybrid organisations must still inventory and patch their on-premises Exchange servers and workstations with Exchange Management Tools. Cloud-hosted mailboxes do not remove a local management server from scope.

The CISA KEV entry is an urgent remediation signal, not evidence that every OWA deployment was targeted.

June Security Update is the durable fix

Microsoft initially delivered risk reduction through Exchange Emergency Mitigation Service rule M2.1.x. It was a pre-update protection and could affect some OWA functions.

The June 2026 Exchange Security Updates permanently fix CVE-2026-42897. Updates cover Exchange SE RTM, Exchange 2019 CU14/CU15 and Exchange 2016 CU23. For Exchange 2016 and 2019 after standard support, access requires Period 2 ESU.

Installing the June SU does not automatically remove the earlier mitigation. Microsoft recommends temporarily retaining it as defence in depth. If it causes operational problems, install the SU first and then follow the vendor’s removal procedure.

Administrator action plan

1. Inventory every server, hybrid management host and Exchange Management Tools installation.
2. Verify CU level and entitlement to the update.
3. Install the June 2026 SU across all relevant nodes.
4. Restart servers and confirm all Exchange services return to a healthy state.
5. Run Exchange Health Checker before and after deployment.
6. Confirm M2.1.x status and follow Microsoft’s sequence if it must be removed.

Patch first. Mail filters and user awareness remain supporting layers because the malicious message must arrive and be opened. Review suspicious HTML emails and OWA-session anomalies from the vulnerable period, but do not claim exploitation from one generic signal.

CVE-2026-42897 is a serious OWA XSS with confirmed exploitation. Treat it accurately: crafted email plus opening and interaction, not server RCE. Patch all on-premises Exchange nodes and verify the result with Health Checker.

---

Sources: Microsoft vulnerability analysis, June 2026 Security Updates, CISA KEV.