There is no patch - only a temporary mitigation. CISA adds CVE to the Financial Exploited Vulnerabilities catalog on May 15 with a deadline of May 29. 14 days to respond. For SOC teams that are accustomed to detecting Exchange-incidents on server IOCs - web-slopes, anomalous IIS processes, a suspicious outbound - a scenario begins where the usual playbooks are useless. The attack is entirely played out in the victim’s browser. Not on the server. In the browser.
Technical anatomy CVE-2026-42897
Root call - CWE-79 (IMproper Neutralization of Input During Web Page Generation): Exchange Server does not sufficiently sanitize the content of incoming emails when rendering in OWA. An attacker without authentication can perform spoofing over the network. According to OWASP Top 10 2021 vulnerability falls under A03:2021 (Injection, where XSS is included); in the current OWASP Top 10 2025 - under A05:2025 (Injection), and its consequences - unauthorized access to the contents of the mailbox - are laid in A01:2021 (Broken Access Control).
NVD in enrichment confirms CVSS 8.1 (High) with vector S:U/C/I:H - Scope Unchanged, Confidentiality and Integrity Impact remain High. MSRC uses its own quality scale and classifies vulnerability as Critical (impact: Spoofing), despite CVSS 8.1 (High). Disappearance standard - MSRC takes into account the business context and the value of the target infrastructure. Simply put, Exchange with CFO mail for Microsoft is more critical than an abstract CVSS score.
EPS-estate: 0.0564, percentile 0.9206 - vulnerability in the top-10% due to the probability of operation in the next 30 days (full cycle from CVE analysis to the working oven is disassembled in CVE Exploit Development Manual) CISA SSVC Decision: Act (active operation, automatization is impossible, a complete technical impact).
Thrown up versions of Exchange Server
According to NVD and MSRC, on-premises versions are vulnerable:
• Exchange Server 2016 CU23
• Exchange Server 2019 CU14
• Exchange Server 2019 CU15
• Exchange Server Subscription Edition RTM
[Accurate build numbers check with KB5094139/KB5094140/KB5094142 after installing the patch]
Exchange Online is not affected. Organizations without ESU-Subscription remain with a temporary mitigation as the only defense - direct illustration OWASP A06:2021 (Vulnerable and Outdated Components). Vendor has already stopped fully supporting the infrastructure, and it is still standing in the market.
What this gives the attacker in practice: read correspondence, send letters on behalf of the victim for BEC-schemes, collect investments from correspondence with the legal or financial department, modify the rules of the forwarding. And all this - from the trusted OWA interface, without a single alert on the server.
Chain with Mapping MITRE ATT&CK
1. Delivery. Delivery. The attacker generates a letter with a ostebatic JavaScript in the body. Delivery with standard SMTP flow. Mapping: Phishing (T1566, Initial Access).
2. Trigger. The victim opens a letter to OWA. Exchange rendereds unsustainable HTML, JavaScript is executed in the context of an authenticated browser session. Microsoft clarifies: the operation takes place "under certain conditions of interaction" - a specific rendering path or the state of the interface is not disclosed. Mumping: Exploitation for Client Execution (T1203, Execution)
3. Gathering. The script interacts with the OWA-session: session tokens, contents of the mailbox, attachments, contact lists. Mumping: Email Collection (T1114, Collection) - Subtechnics T1114.002 (Remone Email Collection) described by MITRE for Exchange/Office 365, Atomic Red Team tests are only available for Office 365.
4. Action. Sending emails on behalf of the victim, creating inbox rules for shipment. Possible cleaning of the traces: Clear Mailbox Data (T1070.008).
Why the standard playbook doesn't work
Let's remember ProxyLogon (CVE-2021-26855, CVSS 9.1, Critical, CWE-918) - SSRF with RCE on the Exchange server, also lit up in ransomware campaigns and CISA KEV. There the attacker left the web-shelf (T1505.003), started the processes via PowerShell (T1059.001), created server artifacts. For ProxyLogon, there are public PoCs (SharpProxyLogon, exprolog on GitHub), Nuclei templates for scanning, and over the years has accumulated a solid IOC base.
CVE-2026-42897 works differently:
• No malicious attachment for detonation in sandbox
• No link to lock to mail gateway
• No web store on the server file system
• There is no anomalous process in IIS worker
• No suspicious outbound from Exchange host
The letter itself is an exploit. Compromise occurs in the browser - invisible to EDR on the Exchange host and for IDS on the perimeter. Destop customers Outlook, Exchange ActiveSync and other access methods are not currently identified as a vector of operation.
Scale of the problem
The context is larger than one CVE. According to the Kiteworks report, shortly after the disclosure CVE-2026-42897 Pwn2Own Berlin showed additional Exchange-bags with RCE from SYSTEM, which launched a 90-day disclosure-time. The surface of the attack of Exchange Server does not narrow - it expands.
Detection: what to look for in the logs with Exchange email spoofing attack
Adjustments to the environment
• Access to IIS-logs Exchange Server (by default %SystemDrive%\inetpub\logs\LogFiles\)
• Access to Exchange HttpProxy-logs (%ExchangeInstallPath%\Logging\HttpProxy\OwaProxy\)
• SIEM with a customized collection of these sources (Splunk, Elastic, MaxPatrol SIEM)
• PowerShell 5.1+ on Exchange Server
IIS-logs: anomalies of OWA-sessions
Specific URL-pattern for CVE-2026-42897 in public sources there is no - Microsoft did not disclose the details of the peload. Detection is based on the detection of abnormal behavior after potential exploitation:
• Multiple POST requests to /owa/endpoints from one session in a short interval - especially to the API to the email reading and downloading of investments
• OWA-sessions with IP addresses that do not match the user baseline
• Sharp increase in query volume from OWA-context for a particular mailbox
Code:
Select-String -Path "$env:SystemDrive\inetpub\logs\LogFiles\W3SVC1\*.log" ` -Pattern "POST.*/owa/" | ForEach-Object { ($_ -split '\s+')[2] } | Group-Object | Where-Object { $_.Count -gt 20 } | Sort-Object Count -Descending
Postal flow: at the level of hunting transport
On mail gateway or through Exchange Transport Rules - alertes for letters with suspicious HTML structures in the body: obfuscated JavaScript (encode/decode, String.fromCharCode), actual eventrs (onerror, onload, onmouseover), nested <script> tags. There is no magic - the usual pattern matching, but it at least cut off the dumbest versions of the peyloade.
Sessional anomalies
After the operation of the XSS, the attacker acts on behalf of the victim in the framework of the legitimate OWA-session. Correlation in SIEM:
• Sending emails to the uncharacteristic time for the user
• Creating or modifying inbox rules via OWA: check by the team Get-InboxRule -Mailbox <user> | Where-Object { $.ForwardTo -or $.RedirectTo }
• Massive reading of attachments from correspondence, to which the user usually does not apply
• Actions in the OWA from the user who usually works through the desktop Outlook (and then suddenly climbed into the web interface - suspiciously)
Emergency mitigation Exchange Server: EMSS and EOMT
Adjustments to the environment
• Exchange Server is not lower than March 2023 CU (for EEMS)
• Elevated Exchange Management Shell for EOMT
• Network connection to Microsoft Office Config Service (for EEMS)
• For air-gapped environments: EOMT downloads in advance
Option 1: EEMS (recommended)
Exchange Emergency Mitigation Service has been included by default since September 2021. If the service is active and the server has a link to OCS - the M2.1.x mitigation is automatically used. Check: Launch Exchange Health Checker (HealthChecker - Microsoft - CSS-Exchange), in the HTML report to find the EEMS section. If M2.1.2.1x is "Applied" status - the server is protected. The inscription "Mitigation invalid for this exchange version" in detail - cosmetic bug. At the status of the Applied, the mitigation works correctly, according to Microsoft Exchange Team.
Option 2: EOMT (for isolated media)
Code:
.\EOMT.ps1 -CVE "CVE-2026-42897"
Get-ExchangeServer | Where-Object { $_.ServerRole -ne "Edge" } |
.\EOMT.ps1 -CVE "CVE-2026-42897"
Limitations of the mitigation
The mitigation is based on Content Security Policy (CSP) Headlines. Two fundamental limitations, and both unpleasant:
Internet Explorer and Edge in IE Mode Do not support CSP. For users of these browsers, the mitigation does not protect. This is blind spot that SOC is required to take into account. Yes, in 2025, IE is still found in corporate environments – and exactly where Exchange on-prem.
Side Effects:
• The printing of the calendar in OWA (workaround: Outlook Desktop) does not work
• Inline images may be displayed incorrectly in reading pane (workaround: send as attachments)
• OWA Light stops working (deprecated, will be turned off completely)
• Healthset OWACalendar.Proxy can show untails untailing - ignore in monitoring to a full patch
• Published calendars can return a 500 error
Inform help desk and users to application of the mitigation. Not after. Otherwise, the tickets will arrive earlier than you finish KB-article into the inner wiki.
The status of the recommendation for the preservation of mitigation after the installation of the patch requires reconciliation with the current MSRC advisory at the time of reading.
Technical anatomy CVE-2026-42897
Root call - CWE-79 (IMproper Neutralization of Input During Web Page Generation): Exchange Server does not sufficiently sanitize the content of incoming emails when rendering in OWA. An attacker without authentication can perform spoofing over the network. According to OWASP Top 10 2021 vulnerability falls under A03:2021 (Injection, where XSS is included); in the current OWASP Top 10 2025 - under A05:2025 (Injection), and its consequences - unauthorized access to the contents of the mailbox - are laid in A01:2021 (Broken Access Control).
NVD in enrichment confirms CVSS 8.1 (High) with vector S:U/C/I:H - Scope Unchanged, Confidentiality and Integrity Impact remain High. MSRC uses its own quality scale and classifies vulnerability as Critical (impact: Spoofing), despite CVSS 8.1 (High). Disappearance standard - MSRC takes into account the business context and the value of the target infrastructure. Simply put, Exchange with CFO mail for Microsoft is more critical than an abstract CVSS score.
EPS-estate: 0.0564, percentile 0.9206 - vulnerability in the top-10% due to the probability of operation in the next 30 days (full cycle from CVE analysis to the working oven is disassembled in CVE Exploit Development Manual) CISA SSVC Decision: Act (active operation, automatization is impossible, a complete technical impact).
Thrown up versions of Exchange Server
According to NVD and MSRC, on-premises versions are vulnerable:
• Exchange Server 2016 CU23
• Exchange Server 2019 CU14
• Exchange Server 2019 CU15
• Exchange Server Subscription Edition RTM
[Accurate build numbers check with KB5094139/KB5094140/KB5094142 after installing the patch]
Exchange Online is not affected. Organizations without ESU-Subscription remain with a temporary mitigation as the only defense - direct illustration OWASP A06:2021 (Vulnerable and Outdated Components). Vendor has already stopped fully supporting the infrastructure, and it is still standing in the market.
What this gives the attacker in practice: read correspondence, send letters on behalf of the victim for BEC-schemes, collect investments from correspondence with the legal or financial department, modify the rules of the forwarding. And all this - from the trusted OWA interface, without a single alert on the server.
Chain with Mapping MITRE ATT&CK
1. Delivery. Delivery. The attacker generates a letter with a ostebatic JavaScript in the body. Delivery with standard SMTP flow. Mapping: Phishing (T1566, Initial Access).
2. Trigger. The victim opens a letter to OWA. Exchange rendereds unsustainable HTML, JavaScript is executed in the context of an authenticated browser session. Microsoft clarifies: the operation takes place "under certain conditions of interaction" - a specific rendering path or the state of the interface is not disclosed. Mumping: Exploitation for Client Execution (T1203, Execution)
3. Gathering. The script interacts with the OWA-session: session tokens, contents of the mailbox, attachments, contact lists. Mumping: Email Collection (T1114, Collection) - Subtechnics T1114.002 (Remone Email Collection) described by MITRE for Exchange/Office 365, Atomic Red Team tests are only available for Office 365.
4. Action. Sending emails on behalf of the victim, creating inbox rules for shipment. Possible cleaning of the traces: Clear Mailbox Data (T1070.008).
Why the standard playbook doesn't work
Let's remember ProxyLogon (CVE-2021-26855, CVSS 9.1, Critical, CWE-918) - SSRF with RCE on the Exchange server, also lit up in ransomware campaigns and CISA KEV. There the attacker left the web-shelf (T1505.003), started the processes via PowerShell (T1059.001), created server artifacts. For ProxyLogon, there are public PoCs (SharpProxyLogon, exprolog on GitHub), Nuclei templates for scanning, and over the years has accumulated a solid IOC base.
CVE-2026-42897 works differently:
• No malicious attachment for detonation in sandbox
• No link to lock to mail gateway
• No web store on the server file system
• There is no anomalous process in IIS worker
• No suspicious outbound from Exchange host
The letter itself is an exploit. Compromise occurs in the browser - invisible to EDR on the Exchange host and for IDS on the perimeter. Destop customers Outlook, Exchange ActiveSync and other access methods are not currently identified as a vector of operation.
Scale of the problem
The context is larger than one CVE. According to the Kiteworks report, shortly after the disclosure CVE-2026-42897 Pwn2Own Berlin showed additional Exchange-bags with RCE from SYSTEM, which launched a 90-day disclosure-time. The surface of the attack of Exchange Server does not narrow - it expands.
Detection: what to look for in the logs with Exchange email spoofing attack
Adjustments to the environment
• Access to IIS-logs Exchange Server (by default %SystemDrive%\inetpub\logs\LogFiles\)
• Access to Exchange HttpProxy-logs (%ExchangeInstallPath%\Logging\HttpProxy\OwaProxy\)
• SIEM with a customized collection of these sources (Splunk, Elastic, MaxPatrol SIEM)
• PowerShell 5.1+ on Exchange Server
IIS-logs: anomalies of OWA-sessions
Specific URL-pattern for CVE-2026-42897 in public sources there is no - Microsoft did not disclose the details of the peload. Detection is based on the detection of abnormal behavior after potential exploitation:
• Multiple POST requests to /owa/endpoints from one session in a short interval - especially to the API to the email reading and downloading of investments
• OWA-sessions with IP addresses that do not match the user baseline
• Sharp increase in query volume from OWA-context for a particular mailbox
Code:
Select-String -Path "$env:SystemDrive\inetpub\logs\LogFiles\W3SVC1\*.log" ` -Pattern "POST.*/owa/" | ForEach-Object { ($_ -split '\s+')[2] } | Group-Object | Where-Object { $_.Count -gt 20 } | Sort-Object Count -Descending
Postal flow: at the level of hunting transport
On mail gateway or through Exchange Transport Rules - alertes for letters with suspicious HTML structures in the body: obfuscated JavaScript (encode/decode, String.fromCharCode), actual eventrs (onerror, onload, onmouseover), nested <script> tags. There is no magic - the usual pattern matching, but it at least cut off the dumbest versions of the peyloade.
Sessional anomalies
After the operation of the XSS, the attacker acts on behalf of the victim in the framework of the legitimate OWA-session. Correlation in SIEM:
• Sending emails to the uncharacteristic time for the user
• Creating or modifying inbox rules via OWA: check by the team Get-InboxRule -Mailbox <user> | Where-Object { $.ForwardTo -or $.RedirectTo }
• Massive reading of attachments from correspondence, to which the user usually does not apply
• Actions in the OWA from the user who usually works through the desktop Outlook (and then suddenly climbed into the web interface - suspiciously)
Emergency mitigation Exchange Server: EMSS and EOMT
Adjustments to the environment
• Exchange Server is not lower than March 2023 CU (for EEMS)
• Elevated Exchange Management Shell for EOMT
• Network connection to Microsoft Office Config Service (for EEMS)
• For air-gapped environments: EOMT downloads in advance
Option 1: EEMS (recommended)
Exchange Emergency Mitigation Service has been included by default since September 2021. If the service is active and the server has a link to OCS - the M2.1.x mitigation is automatically used. Check: Launch Exchange Health Checker (HealthChecker - Microsoft - CSS-Exchange), in the HTML report to find the EEMS section. If M2.1.2.1x is "Applied" status - the server is protected. The inscription "Mitigation invalid for this exchange version" in detail - cosmetic bug. At the status of the Applied, the mitigation works correctly, according to Microsoft Exchange Team.
Option 2: EOMT (for isolated media)
Code:
.\EOMT.ps1 -CVE "CVE-2026-42897"
Get-ExchangeServer | Where-Object { $_.ServerRole -ne "Edge" } |
.\EOMT.ps1 -CVE "CVE-2026-42897"
Limitations of the mitigation
The mitigation is based on Content Security Policy (CSP) Headlines. Two fundamental limitations, and both unpleasant:
Internet Explorer and Edge in IE Mode Do not support CSP. For users of these browsers, the mitigation does not protect. This is blind spot that SOC is required to take into account. Yes, in 2025, IE is still found in corporate environments – and exactly where Exchange on-prem.
Side Effects:
• The printing of the calendar in OWA (workaround: Outlook Desktop) does not work
• Inline images may be displayed incorrectly in reading pane (workaround: send as attachments)
• OWA Light stops working (deprecated, will be turned off completely)
• Healthset OWACalendar.Proxy can show untails untailing - ignore in monitoring to a full patch
• Published calendars can return a 500 error
Inform help desk and users to application of the mitigation. Not after. Otherwise, the tickets will arrive earlier than you finish KB-article into the inner wiki.
The status of the recommendation for the preservation of mitigation after the installation of the patch requires reconciliation with the current MSRC advisory at the time of reading.
