This vulnerability (CWE-79) arises from improper neutralization of input during web page generation in Microsoft Exchange Server 2016 CU23, specifically affecting Outlook Web Access. Exploitation allows remote attackers to execute arbitrary JavaScript code in the victim's browser, leading to session compromise and persistent implant installation. The implant communicates covertly and exfiltrates data via HTTP and DNS channels. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low complexity, no privileges required, user interaction required, and high confidentiality and integrity impacts. An official fix is available from Microsoft.

Successful exploitation results in high-impact consequences including full compromise of Outlook Web Access sessions, theft of user credentials, installation of a persistent JavaScript implant that survives common remediation efforts, and covert data exfiltration. This enables long-term espionage and data theft from targeted organizations, particularly in government and critical infrastructure sectors. The vulnerability allows attackers to bypass credential rotation and device re-imaging, maintaining persistent access.

An official fix is available from Microsoft and should be applied immediately to affected on-premises Microsoft Exchange Server 2016 Cumulative Update 23 installations (version 15.01.0.0). The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 provides detailed patching instructions. Since this is not a cloud service, organizations must patch their servers directly. No additional mitigation steps beyond applying the official fix are indicated.