EXPOSURES › CVE-2026-42897
CVE-2026-42897
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Exchange Server XSS vulnerability allows arbitrary JavaScript execution in Outlook Web Access browser context.
This XSS flaw enables attackers to inject malicious scripts into Outlook Web Access, potentially leading to credential theft or session hijacking. DIB organizations must patch immediately to prevent unauthorized access to sensitive data via compromised web sessions.
Shame score — A known XSS vulnerability in a widely deployed enterprise product that allows script execution in the browser context.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |