HIGHVulnerability
Verified
Global

CISA KEV: Microsoft Microsoft — Microsoft Exchange Server Cross-Site Scripting Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Analysis

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Added to CISA Known Exploited Vulnerabilities catalog on 2026-05-15. Remediation due: 2026-05-29.

Indicators of Compromise (1)

CVE (1)
CVE-2026-42897
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on May 15, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

FSB Group Gamaredon Hides Worm in Windows Data Streams

FSB-linked Gamaredon concealed a fileless worm in NTFS data streams to spy on Ukraine targets

Infosecurity Magazine
MEDIUMVulnerabilityNEW

Microsoft fixes KB5089549 Windows security update install issues

Microsoft has resolved a known issue causing installation failures and 0x800f0922 errors when deploying the May 2026 Windows 11 security update (KB5089549). [...]

BleepingComputer
MEDIUMVulnerability

Hercle appoints Gabriele Zuliani chief revenue officer

Hercle, the leading institutional cross-border payments infrastructure company, today announced the appointment of Gabriele Zuliani as Chief Revenue Officer. Zuliani joins to drive commercial strategy and revenue growth as Hercle scales its network of 200+ institutional clients, including banks, fintechs, PSPs, and corporate treasuries, across global corridors.

Finextra