CVE-2026-42897

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVSS Metrics

• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
• v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 5.64%• Percentile: 92%

Techniques & Countermeasures

• CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

• Unknown•Exchange Server

  na | 2016 | 2016:cumulative_update_1 | 2016:cumulative_update_10 | 2016:cumulative_update_11 | 2016:cumulative_update_12 | 2016:cumulative_update_13 | 2016:cumulative_update_14 | 2016:cumulative_update_15 | 2016:cumulative_update_16 | 2016:cumulative_update_17 | 2016:cumulative_update_18 | 2016:cumulative_update_19 | 2016:cumulative_update_2 | 2016:cumulative_update_20 | 2016:cumulative_update_21 | 2016:cumulative_update_22 | 2016:cumulative_update_23 | 2016:cumulative_update_3 | 2016:cumulative_update_4 | 2016:cumulative_update_5 | 2016:cumulative_update_6 | 2016:cumulative_update_7 | 2016:cumulative_update_8 | 2016:cumulative_update_9 | 2019 | 2019:cumulative_update_1 | 2019:cumulative_update_10 | 2019:cumulative_update_11 | 2019:cumulative_update_12 | 2019:cumulative_update_13 | 2019:cumulative_update_14 | 2019:cumulative_update_2 | 2019:cumulative_update_3 | 2019:cumulative_update_4 | 2019:cumulative_update_5 | 2019:cumulative_update_6 | 2019:cumulative_update_7 | 2019:cumulative_update_8 | 2019:cumulative_update_9

• microsoft•exchange_server_subscription_edition

  < 15.02.2562.043

• microsoft•microsoft exchange server 2016 cumulative update 23

  - | ≥ 15.01.0.0, < publication | ≥ 15.01.0.0, < 15.01.2507.069

• microsoft•microsoft exchange server 2019 cumulative update 14

  - | ≥ 15.02.0.0, < publication | ≥ 15.02.0.0, < 15.02.1544.041

• microsoft•microsoft exchange server 2019 cumulative update 15

  - | ≥ 15.02.0.0, < publication | ≥ 15.02.0.0, < 15.02.1748.046

• microsoft•microsoft exchange server subscription edition rtm

  - | ≥ 15.02.0.0, < publication | ≥ 15.02.0.0, < 15.02.2562.043

References (2)

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897