CISA confirmed this vulnerability is used in real attacks on 15.05.2026. Remediation deadline for US federal agencies: 29.05.2026.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| microsoft | exchange server | 2016 | |
| microsoft | exchange server 2016 | 15.01.0.0 – < 15.01.2507.069 | |
| microsoft | exchange server 2019 | 15.02.0.0 – < 15.02.1544.041 | |
| microsoft | exchange server se | 15.02.0.0 – < 15.02.2562.043 | |
| microsoft | exchange server subscription edition | < 15.02.2562.043 | |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 | 15.01.0.0 – < 15.01.2507.069 | |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 14 | 15.02.0.0 – < 15.02.1544.041 | |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 15 | 15.02.0.0 – < 15.02.1748.046 | |
| Microsoft | Microsoft Exchange Server Subscription Edition RTM | 15.02.0.0 – < 15.02.2562.043 |
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:* < 15.02.2562.043Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.