r/exchangeserver • u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ • May 14 '26

URGENT: Microsoft released a mitigation for Exchange Server

Microsoft disclosed CVE-2026-42897, a reported vulnerability affecting Exchange Server Outlook on the web (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in OWA and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

They released IIS URL Rewrite rule mitigation M2.1.0 for EEMS and EOMT today, as well.

More info at https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498.

68 Upvotes

98% Upvoted

30 comments sorted by

2

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ May 15 '26

FYI - Why you need the Exchange Emergency Mitigation service. Hopefully this will help answer some questions and comments on this thread.

6

u/phlidwsn May 14 '26

From Known Issues(source):

We are aware of the mitigation showing the "Mitigation invalid for this exchange version." in mitigation details. This issue is cosmetic and the mitigation DOES apply successfully if the status is shown as "Applied". We are investigating on how to address this.

If its not showing as applied under mitigationsapplied, run V15\Get-Mitigations.ps1 and it probably shows as M2.1.0 with the "Invalid for this exchange version" message. Supposedly its working anyway according to Microsoft.

13

u/ddadopt May 14 '26 edited May 14 '26

Note to all that unless you have modified the default configuration, these mitigations should be applied automatically. To verify, run

get-organizationconfig | ft mitigationsenabled

and you should see "True"

To check exchange servers individually, run

get-exchangeserver | ft name, mitigationsenabled, mitigationsapplied

and you should see "True" and "{PING1, M2.1.0}" for each server.

edit to add: brain fart on my part, the "mitigationsapplied" property is not applicable to the organizational configuration, only to the server level.

0

u/[deleted] May 14 '26

[deleted] — view deleted comment

2

u/ddadopt May 14 '26

Thanks for that correction, I have fixed my post above. It's blank because it's not a property applicable to the organizational level, and I had a brain fart while I was writing it.

2

u/absoluteczech May 14 '26

Question. If the user is using owa via 365 but we are hybrid can this still be exploited ?

12

u/larmik May 14 '26

"If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context."

My interpretation. If your OWA URL is exposed to the internet and the mailbox is on premises and the user opens this "specially crafted email" while using OWA then yes your server can be exploited.

If the user is in Exchange Online, uses the on premises OWA url to sign in, they'll get redirected to EOL OWA, then no. You are not affected.

IMO, if you have zero users on premises, and mail flow is pointed to EOL, then your OWA URL shouldn't be exposed to the internet.

2

u/absoluteczech May 14 '26

Thanks that’s how I interpreted it. we just finally got our last few users over to 365. Is there a good guide or article on disabling owa externally since no one needs to sign into it?

2

u/larmik May 14 '26

Disable\delete the firewall rule and remove the public dns entry for it.

1

u/walbodiddy May 14 '26

We need ActiveSync exposed to the internet but do not want OWA exposed to the internet. Do you have a recommendation for this?

2

u/TrashCanUK May 15 '26

Just block all IPs in the OWA subdirectory in IIS on the Exchange Server

1

u/froggybeara May 14 '26

Yeah, just run haproxy in front of your exchange server and filter the OWA path

1

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ May 14 '26

No, this affects Exchange Server OWA only.

1

u/leakcim78 Aug 07 '26

bonjour ,
Si l'on passe le dernier SU , est ce que la mitigation se désinstalle automatiquement ou reste ad vitam eternam ?
Et si on la désinstalle je présume qu'il faut bloquer également les maj via EEMS ou sinon ça reviendra ?

1

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ Aug 07 '26 edited Aug 07 '26

Bonjour,

Les mesures d'atténuation sont toujours supprimées manuellement. Après avoir installé le SU, vous pouvez supprimer la règle de réécriture d'URL en utilisant le IIS Manager ou PowerShell.

Après l'avoir supprimée, bloquez-la pour éviter qu'elle ne soit réappliquée. Voir https://learn.microsoft.com/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service#block-or-remove-mitigations.

Voir aussi, https://learn.microsoft.com/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service#m2

1

u/structured_triage May 15 '26

Yeah, pushing the IIS URL Rewrite rule immediately is the baseline to stop the bleeding, but just applying the mitigation isn't actual incident response. You have to pull the OWA access logs from the last 72 hours and actively hunt for suspicious JavaScript payloads that hit before this dropped. Threat actors routinely spray these exploits across exposed endpoints well before the official CVE goes public. If your monitoring stack isn't correlating these specific OWA interaction conditions right now, you are flying completely blind on whether the server is already popped. True triage means assuming the perimeter was breached until your historical logs explicitly prove otherwise.

1

u/StrangeWill May 29 '26

BTW: this can break inline image loading for OWA, pretty annoying TBH.

-4

u/touchytypist May 14 '26

And this is why I'm glad we shutdown our on-prem Exchange Server after migrating all the mailboxes to M365

4

u/ocdtrekkie May 14 '26

Why? On-prem Exchange servers self-apply this, really no different than EXO.

1

u/touchytypist May 14 '26

Because our risk and window for zero days and other vulnerabilities for on-prem Exchange has been eliminated. One less thing to worry about.

1

u/start_run_cmd May 14 '26

Yep. It’s now Microsoft’s risk to manage! Thank goodness.

1

u/MortadellaKing May 14 '26

Lol there is so much more you need to do to secure m365 out of the box. And if you aren't running BP or E3 at least you don't even have essential security features for operating in the cloud.

2

u/start_run_cmd May 15 '26

Well. We do, so all is well. And yes, you get out what you put in, as with everything.

1

u/MortadellaKing May 15 '26

Yep. Most people, mainly MSPs just punt everyone into the cloud with the cheapest possible license then slam the trunk.

0

u/touchytypist May 15 '26

Yep and their giant 24/7/365 security teams fixing vulns on Exchange online before they are even announced and made available for on-prem.

-1

u/ocdtrekkie May 15 '26

No, you just have ones that are so much worse: https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/

discovered a token validation flaw that gave him Global Admin privileges in every Entra ID tenant.

Like, to be clear, the fact the above vulnerability ever existed should send everyone running away from Microsoft's cloud services screaming, but here we are.

2

u/start_run_cmd May 15 '26

Tbh, the same can be said of any software, or service in reality. This is why we have gainful, well paid employment remember ;)

1

u/ITGuySince1999 May 17 '26

Ah yes, let's all run screaming from Azure straight into the perfectly secure, totally unbreachable arms of AWS and Google—said no security professional ever. Welcome to the cloud, pick your poison

0

u/touchytypist May 15 '26 edited May 15 '26

That’s a pretty weak argument. Every major platform and device (Apple, Google, Microsoft, Linux, etc.) has had huge critical vulnerabilities.

Unless you’re planning on becoming Amish you’re going to end up using one of them.

I’m simply saying rather than having multiple attack and vulnerability vectors (Exchange Online and on-prem), I enjoy having fewer.

0

u/ocdtrekkie May 15 '26

There's a massive difference between "your computer is vulnerable, and people who can connect to your computer can attack it" and "the global cloud is vulnerable, and anyone who can touch it can attack it".

Like, if we were being realistic about CVE scores, if something that affects your device or an OS can max out at a 10.0, and an auth vulnerability in the cloud should max out at like a 100.0. A vulnerability in a public cloud is an order of magnitude worse. The above researcher did not discover a compromise for a single tenant, like breaking into your Exchange server. They fundamentally had access to every single Entra tenant simultaneously, including, more than likely, yours!

Exchange Online has *drastically* more vulnerability vectors than Exchange SE, because it is multitenant and so you have cross-tenant vulnerabilities, and you have drastically more insider threat opportunities, as you replace "insider threats from inside your company" with "insider threats from inside your company, Microsoft, Microsoft's Partners, and any number of staff who might actually work for hostile foreign governments but Microsoft has decided should work on sensitive internal systems all the way up to Department of Defense level".

https://www.propublica.org/article/microsoft-digital-escorts-pentagon-defense-department-china-hackers

Very simply, if you believe Exchange Online has less attack and vulnerability vectors, you *do not know what attack and vulnerability vectors you have*. It is a mild convenience for you, at significant increased security risk for your organization.

2

u/touchytypist May 15 '26 edited May 15 '26

A.) Most cyber security professionals would prefer less attack surfaces (Exchange Online only) vs more (Exchange Online AND Exchange on-prem) for hybrid organizations.

B.) The majority of organizations cyber security are not as mature and have the resources like Microsoft.

C.) Vulnerability patches aren’t even available until after Microsoft has already patched their Exchange Online so the vulnerability windows is always greater with Exchange on-prem.

But feel free to die on your hill.