Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
Source SecurityWeek
Exploited in the wild · KEV due 29 May 2026 : upgrade to 15.01.2507.069 now.
Data as of 18 May 2026, 10:52 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
- Patch
- Available – fixed in 15.01.2507.069, 15.02.1544.041, 15.02.1748.046 +1
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 14 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 1 day after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by microsoft
, 14 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 36 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 1 day after disclosure
KEV remediation due
US federal deadline
, 15 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 23 | Affected
| Fixed in
|
| MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 14 | Affected
| Fixed in
|
| MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 15 | Affected
| Fixed in
|
| MicrosoftMicrosoft Exchange Server Subscription Edition RTM | Affected
| Fixed in
|
AI-suggested
Microsoft has shared mitigation options to reduce risk until a permanent patch is released. Organizations should apply these mitigations immediately as recommended by Microsoft. The vendor advisory does not indicate that no action is required or that the issue is already mitigated, so applying the recommended mitigations is advised.
Description
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions. The post Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild appeared first on SecurityWeek .