PT-2026-40978 · Microsoft · Exchange Server

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-42897

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description Improper neutralization of input during web page generation leads to cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites. This allows an unauthorized attacker to perform spoofing over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42897

Affected Products

Exchange Server

References · 10

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42897 · Security Note
• https://twitter.com/MSFTExchange/status/2054970312987398239 · Twitter Post
• https://twitter.com/MSITTechNews/status/2054974841082564656 · Twitter Post
• https://reddit.com/r/Office365/comments/1td5tb2/heads_up_exchange_admins_get_your_patching_hat_on · Reddit Post
• https://twitter.com/luisarnauth/status/2054973686818472001 · Twitter Post
• https://twitter.com/schnoll/status/2054979762641408202 · Twitter Post
• https://reddit.com/r/exchangeserver/comments/1td5fxa/urgent_microsoft_released_a_mitigation_for · Reddit Post
• https://twitter.com/Monitoring_IT/status/2054977040256786702 · Twitter Post
• https://twitter.com/schnoll/status/2054975842795893135 · Twitter Post