CVE-2026-42897: Exchange OWA Zero-Day Exploited With No Permanent Patch

A Single Email Can Compromise Your Exchange Mailbox

The mechanics of CVE-2026-42897 are deceptively simple: an attacker sends a specially crafted email to a target mailbox. When the recipient opens that message through Outlook Web Access (OWA), arbitrary JavaScript executes in the browser context — no additional user interaction, no macro enable dialog, no plugin required. The flaw is classified as an improper neutralization of input during web page generation (CWE-79), the formal category for cross-site scripting vulnerabilities.

Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation at the time of disclosure. The CVSS base score of 8.1 reflects the low attack complexity and the high potential for confidentiality and integrity impact. BleepingComputer’s reporting on the Exchange zero-day confirmed that all three currently-supported on-premises Exchange Server versions are affected: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).

What makes this vulnerability particularly dangerous is the timing. The May 12, 2026 Patch Tuesday release addressed 138 vulnerabilities — but CVE-2026-42897 was not among them. Two days later, the zero-day was disclosed and confirmed as actively exploited, leaving organizations with no permanent fix on the standard monthly patching cycle. Microsoft’s TechCommunity blog on the Exchange May 2026 vulnerability confirmed that permanent patches are planned for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14/CU15 — but the release date remains unannounced as of late May 2026.

The Mitigation Picture Is Messier Than It Looks

Microsoft’s primary mitigation response relies on two tools: the Exchange Emergency Mitigation Service (EEMS) for internet-connected servers, and the Exchange On-premises Mitigation Tool (EOMT) for air-gapped environments accessible via PowerShell. EEMS applies interim protections automatically when enabled, making it the fastest available defense for most organizations.

The problem, as TechTimes reported on May 19, is that the mitigation carries documented gaps updated on May 18. Specifically:

• Internet Explorer and IE-compatibility mode are unprotected. Organizations whose users access OWA through Internet Explorer or Microsoft Edge running in IE compatibility mode remain fully exposed even after applying the EEMS fix.
• Legacy clients are uncovered. Any environment that still routes users through IE-based clients has no effective mitigation from EEMS.

Beyond the protection gaps, applying the mitigation breaks legitimate functionality. OWA’s Print Calendar feature stops working. Inline images fail to display correctly in reading panes. The legacy OWA Light interface (accessed via /?layout=light) stops functioning entirely. The OWACalendar.Proxy healthset reports as unhealthy, triggering false monitoring alerts across any platform checking Exchange health endpoints.

CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities catalog on May 15, 2026, one day after disclosure. Federal civilian executive branch (FCEB) agencies must apply mitigations by May 29, 2026 — a two-week window that is already closing for many organizations reading this.

What Enterprise Security Teams Should Do Now

The combination of active exploitation, no permanent patch, a CISA KEV listing, and documented mitigation gaps makes this a Tier 1 response event. The following prescription framework addresses both the immediate containment problem and the medium-term patching readiness gap.

1. Audit EEMS Status and Enable It Immediately on Every Exchange Server

EEMS ships disabled by default on many on-premises deployments, particularly those installed before 2024 when Microsoft began recommending it more actively. Run the following PowerShell check on each Exchange server:

“ Get-ExchangeDiagnosticInfo -Server <ServerName> -Process EdgeTransport -Component VariantConfiguration -Setting Orchestrator “

If EEMS is not running, enable it immediately per the Exchange team’s guidance. For air-gapped servers that cannot reach Microsoft’s mitigation endpoint, deploy EOMT manually. Do not assume servers inherited from acquisitions or legacy environments have EEMS enabled — audit every node explicitly.

2. Inventory and Isolate IE-Dependent OWA Access Paths

The confirmed EEMS protection gap for Internet Explorer is not a theoretical edge case. Many enterprise environments — particularly in manufacturing, healthcare, and government — run line-of-business applications inside IE containers or use Edge’s IE compatibility mode to support legacy intranet tools. Users who access OWA through those same sessions are fully exposed.

Pull access logs from your Exchange servers and identify any OWA sessions using IE user-agent strings. Group Policy can block IE-mode OWA access while still permitting IE for other internal tools. Until the permanent patch ships, treat any IE-mode OWA access as an unmitigated attack surface.

3. Harden OWA URL Routing and Monitor for XSS Indicators

Because the exploit delivers JavaScript via a malicious email body, standard email gateway filtering is a meaningful compensating control — but only for content the gateway can inspect. Encrypted S/MIME messages and certain HTML email structures may bypass gateway rules. Additionally, once JavaScript executes in the OWA browser context, the attacker has access to session cookies, can issue authenticated MAPI-over-HTTP requests, and can exfiltrate mailbox contents silently.

Set up behavioral monitoring for anomalous OWA activity: off-hours access, unexpected bulk mail access, calendar export requests, or forwarding rule creation. These are the downstream indicators of a successful XSS session hijack, and they appear in Exchange audit logs before any endpoint detection fires.

4. Pre-Stage Patches and Test Against Your Customizations

Microsoft has confirmed that permanent patches are coming for Exchange SE RTM, Exchange 2016 CU23, and Exchange 2019 CU14/CU15. Organizations with ESU (Extended Security Update) contracts for Exchange 2019 CU14 are in scope; those running older CUs or out-of-ESU versions must upgrade the cumulative update baseline before the patch can apply.

Start that CU upgrade work now rather than waiting for the permanent patch to ship. Exchange CU upgrades are not trivial on systems with custom transport agents, third-party archiving solutions, or hybrid configurations. Running a test upgrade in a staging environment takes days — having that groundwork done means you can apply the permanent patch within hours of release rather than weeks.

The Structural Risk: On-Premises Exchange Is Still Everywhere

CVE-2026-42897 lands on an installed base that remains far larger than cloud migration timelines suggest. Microsoft 365 has achieved dominant market position for new deployments, but the migration from on-premises Exchange to Exchange Online remains incomplete across large enterprise and regulated-sector segments. Financial regulators, healthcare systems, and government agencies in many jurisdictions mandate data residency requirements that make on-premises Exchange the only compliant option. Critical infrastructure operators often maintain on-premises Exchange inside operational technology networks that are deliberately isolated from cloud connectivity.

The Exchange Server Subscription Edition itself — Microsoft’s 2025 rebranding of on-premises Exchange as a perpetual license product — is a tacit acknowledgment that the on-premises installed base is not going away. Microsoft released Exchange SE specifically to serve organizations that cannot or will not move to Exchange Online. CVE-2026-42897 is, in effect, a vulnerability that Microsoft will need to patch in a product it has explicitly committed to maintaining indefinitely.

For security teams, the lesson is structural: on-premises Exchange requires the same zero-day response cadence as internet-facing web applications — because OWA is, functionally, an internet-facing web application. Organizations that still treat Exchange patching as a quarterly maintenance window rather than a critical response pathway are operating with an outdated risk model.

Frequently Asked Questions

Sources & Further Reading

• Microsoft Warns of Exchange Zero-Day Flaw Exploited in Attacks — BleepingComputer
• Addressing Exchange Server May 2026 Vulnerability CVE-2026-42897 — Microsoft TechCommunity
• Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild — SecurityWeek
• Exchange Server OWA Zero-Day CVE-2026-42897: Exploited, No Permanent Patch, New Mitigation Gaps — TechTimes
• CVE-2026-42897 Microsoft Exchange Server Zero-Day — SecurityAffairs