CVE-2026-42897

This vulnerability is a weakness in how Exchange’s web mail pages handle information, which can let an attacker run harmful “scripts” inside your users’ browsers. In real incidents, attackers trick someone into opening a crafted email, and that can lead to spoofed messages and help the attacker stay inside the email system to steal credentials and sensitive data.

This matters to you if you run Microsoft Exchange Server using Outlook Web Access (OWA) for users to read email in a web browser. It affects specific Exchange Server builds listed for Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, and Microsoft Exchange Server Subscription Edition RTM.

It’s a risk in practice when an attacker can reach your users’ OWA sessions through a malicious email that users open (a “half-click”/user interaction is required).

This is RED because it is confirmed in the CISA KEV and has real-world reports of active exploitation. Attackers are using it to run JavaScript in victims’ browsers via specially crafted emails, then using that access to gain persistent control (OWAReaper) and steal credentials and sensitive information.