Is CVE-2026-42897 (Microsoft Exchange Server Cross-Site Scripting) being exploited in the wild?

Yes. CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities catalogue on 15 May 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

How to interpret “exploited in the wild” for this CVE

For this question, the key point is not whether the flaw exists in theory, but whether there is credible evidence that attackers are using it outside a lab. CISA’s KEV listing is the strongest public signal for that, because it reflects observed exploitation rather than speculative risk. For defenders, that changes the question from “is it serious?” to “is it still exposed?”

Because the weakness is a browser-side cross-site scripting issue in Exchange Server web page generation, exposure depends on whether Outlook Web Access or related web paths are reachable and whether the vulnerable interaction conditions can be triggered. In practice, that means the first step is confirming which Exchange instances, front ends and user access paths are actually internet-facing or otherwise reachable by untrusted users.

What the vulnerability enables when those interaction conditions are met

This is a scripting-in-the-browser problem, not a classic server takeover by itself. If an attacker can trigger the vulnerable page-generation path, arbitrary JavaScript can run in the victim’s browser context, which can expose sessions, manipulate user actions, or redirect the user into follow-on credential theft or phishing flows. The practical impact depends heavily on who is targeted and what the browser session can already reach.

That makes the scope of harm highly contextual. If the targeted user has access to sensitive mailboxes, internal applications or authenticated Exchange features, the XSS can become a stepping stone to broader account abuse. If the affected user is low-privilege and the session is short-lived, the impact may be narrower, but it is still a live exploitation path that warrants immediate attention.

What to do while patching and validation are in progress

The safest response is to treat the KEV listing as an active exploitation indicator and move quickly on exposure reduction. For a web-facing Exchange deployment, that usually means confirming the asset is in scope, applying the vendor fix or mitigation from Microsoft guidance, and reviewing whether any compensating controls can narrow user exposure while change windows are being arranged. CISA’s catalog should be used alongside the vendor advisory for authoritative remediation detail.

If patching must wait, reduce the attack surface rather than assuming the issue can be deferred. Tighten access to Outlook Web Access where possible, increase monitoring for suspicious web activity and token or session abuse, and preserve logs and proxy data so you can investigate whether the vulnerable page path has already been exercised. The goal is to avoid losing forensic visibility while the system remains reachable.

Risk and Threat Considerations

Active exploitation changes the risk profile from preventive hardening to incident-aware response. For an externally reachable Exchange server, the main threat is not only initial XSS execution, but the downstream abuse of authenticated browser sessions and any internal access those sessions expose.

Failure mechanism: The attacker triggers the vulnerable Outlook Web Access page-generation path, JavaScript executes in a legitimate browser session, and the script can act with that user’s authenticated context.

Impact: Session theft, action hijacking, phishing pivots and secondary access to mail or internal resources become plausible, especially where the affected account has broad mailbox or application reach.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events	OWA exploitation is detected by monitoring web and network activity.
Recommendation — Monitor Exchange web traffic and logs for exploit indicators around OWA requests and responses.
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	XSS results from unsafe handling of web input during page generation.
	AU-6 — Audit Review, Analysis, and Reporting	Active exploitation demands log review and correlation across Exchange access paths.
Recommendation — Validate and encode web output to prevent script injection in Exchange pages. Review Exchange and proxy logs for suspicious requests, script injection patterns, and session abuse.
OWASP ASVS	V1 — Encoding and Sanitization	The vulnerability is an output-encoding failure that permits XSS in web content generation.
	V16 — Security Logging and Error Handling	Investigation depends on logs that can reveal exploitation and follow-on abuse.
Recommendation — Apply context-aware output encoding and sanitization to every user-controlled value rendered in Exchange web pages. Log and retain web security events that can show exploit attempts and post-exploitation session abuse.

Practitioner Guidance

What to verify: Confirm whether any Exchange instance is internet-facing, whether the vulnerable web component is enabled, and whether logs show unusual OWA requests, redirects or script-bearing responses around the KEV date.

Decision rule: If the server is exposed and the patch or mitigation is available, treat it as urgent remediation work, not routine backlog grooming. If remediation must be delayed, isolate access paths and raise monitoring fidelity until the fix is applied.

Practitioner takeaway: With a KEV-listed Exchange XSS, the operational question is whether the vulnerable web path is still reachable, because once it is, browser-context abuse can become an immediate account-security problem rather than a theoretical coding flaw.