Microsoft has fixed an actively exploited Exchange Server vulnerability that lets threat actors run arbitrary JavaScript code through cross-site scripting attacks aimed at Outlook Web Access users.

This high-severity spoofing issue tracked as CVE-2026-42897 impacts Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Remote attackers can exploit it without any privileges.

An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context, the Exchange Team said in mid-May when Microsoft deployed automatic temporary mitigation through the Exchange Emergency Mitigation Service.

BleepingComputer has not yet received a response from Microsoft regarding questions about the attacks exploiting CVE-2026-42897.

Yesterday Microsoft issued security updates to resolve the flaw in affected Exchange Server installations and urged admins to apply them as soon as possible while keeping the mitigations active for extra protection.

Microsoft recommends installing the June 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability, it noted in an update to the original security advisory.

As part of our ongoing efforts to strengthen security and improve defenses across environments, we continue to enhance protections for cross-site scripting attacks. We recommend that customers keep the mitigation described in place. The mitigation provides an additional layer of defense and helps ensure continuous protection as further improvements are released.

The Cybersecurity and Infrastructure Security Agency has also added the vulnerability to its list of security flaws exploited in the wild on May 15 and ordered U.S. government agencies to patch their servers within two weeks by May 29.

Over the past five years CISA has added 20 Microsoft Exchange Server vulnerabilities to its list of exploited security flaws with ransomware gangs having exploited 14 of them.

In October weeks after Exchange 2016 and 2019 reached the end of support CISA and the National Security Agency also released guidance on hardening Exchange servers against attacks.