Microsoft Exchange OWA Zero-Day CVE-2026-42897 Analysis

In May 2026, a critical zero-day vulnerability (CVE-2026-42897) was disclosed affecting on-premises Microsoft Exchange Server instances, including 2016, 2019, and the Subscription Edition. The flaw, which has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, allows unauthenticated attackers to perform network-based spoofing and execute arbitrary JavaScript by sending specially crafted emails to users who open them via Outlook Web Access (OWA).

Technically, the vulnerability stems from improper input neutralization (CWE-79) during web page generation in the OWA rendering engine. While Microsoft has deployed temporary mitigations via the Exchange Emergency Mitigation Service (EEMS), a permanent patch is currently only promised for customers enrolled in specific Extended Security Updates (ESU) programs for older versions. This creates a significant risk for organizations maintaining on-premises infrastructure that are not enrolled in these programs.

This threat follows a broader pattern of adversaries targeting mail infrastructure, coinciding with the 'Dead.Letter' Exim vulnerability (CVE-2026-45185). Organizations using on-premises Exchange are urged to apply mitigations immediately, as Exchange vulnerabilities are historically precursors to widespread ransomware campaigns. Federal agencies are mandated by CISA to remediate this vulnerability by May 29, 2026.