Microsoft patches Exchange Server zero-day exploited in attacks

Microsoft released security updates for a zero-day in Microsoft Exchange Server that has been exploited in real-world attacks, enabling attackers to run arbitrary JavaScript via a cross-site scripting (XSS) path that targets Outlook Web Access users. The issue, tracked as CVE-2026-42897, affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE), and can be triggered remotely by sending a crafted email without special privileges. This matters because the flaw allows malicious script execution in the victim’s browser context, increasing the risk of account and session compromise; defenders should apply the June 2026 fixes and keep the related mitigations enabled.