Threat intelligence / Vulnerability
CVE-2026-42897
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Vulnerability
TypeVulnerability
External ID—
First seen2026-05-15
Last seen2026-05-15
Confidence
—
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Labels
CISA KEV context
Vendor / productMicrosoft Microsoft
Added2026-05-15
Due date2026-05-29
7 recorded
Relationships
2 external