CVE-2026-42897 is a zero-day vulnerability affecting Microsoft Exchange Server Subscription Edition, 2016, and 2019. The flaw is an XSS and spoofing issue caused by improper input neutralization during web page generation in Outlook Web Access. Exploitation requires an attacker to send a crafted email that triggers JavaScript execution when opened by the target user in OWA. Microsoft has confirmed exploitation in the wild and shared mitigations but has not yet released a permanent patch. The vulnerability allows unauthorized attackers to perform spoofing over a network by executing arbitrary JavaScript in the browser context of the victim.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser when using Outlook Web Access. This can lead to spoofing attacks and potentially other malicious actions within the user's session. The vulnerability affects multiple Exchange Server versions and is actively exploited in the wild, increasing risk to affected organizations until a patch is available.

Microsoft has shared mitigation options to reduce risk until a permanent patch is released. Organizations should apply these mitigations immediately as recommended by Microsoft. Since no official patch is currently available, monitoring the vendor advisory for updates is critical. The vendor advisory does not indicate that no action is required or that the issue is already mitigated, so applying the recommended mitigations is advised.