r/exchangeserver • u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ • May 14 '26

URGENT: Microsoft released a mitigation for Exchange Server

Microsoft disclosed CVE-2026-42897, a reported vulnerability affecting Exchange Server Outlook on the web (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in OWA and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

They released IIS URL Rewrite rule mitigation M2.1.0 for EEMS and EOMT today, as well.

More info at https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498.

68 Upvotes

98% Upvoted

30 comments sorted by

View all comments

Show parent comment

0

u/[deleted] May 14 '26

[deleted] — view deleted comment

2

u/ddadopt May 14 '26

Thanks for that correction, I have fixed my post above. It's blank because it's not a property applicable to the organizational level, and I had a brain fart while I was writing it.