Microsoft Exchange XSS Flaw Under Active Exploit, No Patch Yet
The temporary mitigation arrives through Exchange Emergency Mitigation Service, organizations that disabled EEMS after earlier headaches should check whether it's running.
TL;DR
A cross-site scripting vulnerability in Microsoft Exchange Server (CVE-2026-42897) allows arbitrary code execution via a specially crafted email opened in Outlook Web Access. Microsoft confirms active exploitation and has released a temporary mitigation through the Exchange Emergency Mitigation Service, but no patch date has been set. On-premises Exchange deployments (including those at defense contractors, state and local agencies, and MSPs) are affected; Exchange Online is not. Organizations that disabled EEMS, or never enabled it, need to apply manual mitigation steps from Microsoft's guidance immediately.
Microsoft disclosed Thursday that CVE-2026-42897, a cross-site scripting vulnerability in Exchange Server, is under active exploitation. There is no patch yet. The company has provided a temporary mitigation delivered through the Exchange Emergency Mitigation Service (EEMS), the same mechanism that pushed interim protections during the 2021 Hafnium/ProxyLogon crisis.
The practical risk sits squarely with on-premises Exchange shops. Exchange Online isn't affected. That means defense contractors running their own Exchange farms, state and local government agencies, and the MSPs that manage email for all of the above are the population that needs to move. The exploit requires more than just opening a malicious email, there are additional user-interaction conditions that narrow the blast radius compared with something like ProxyLogon. But the payload runs JavaScript in the browser's context, which is enough to steal session tokens, pivot laterally, or exfiltrate whatever the user's OWA session can touch.
The patch gap and the compliance question
Microsoft's advisory doesn't specify when a patch will ship, and it doesn't characterize whether the EEMS mitigation fully closes the attack vector or merely reduces the attack surface. That ambiguity matters for organizations subject to contractual or regulatory patch-within-X-days obligations, a mitigation, however effective, may not satisfy a DFARS 7012 requirement to remediate within a specified window, or an agency's internal SLA that counts patches shipped.
What to do Monday
If EEMS is enabled and running, the mitigation should already be in place. The responsible move is to verify that status, not assume it. Organizations that turned EEMS off (and plenty did, during earlier Exchange update cycles where the service caused its own disruptions) need to apply the manual mitigation steps in Microsoft's technical community guidance. While waiting for a patch, reverse proxy or WAF rules that strip or sanitize suspicious OWA parameters are a useful temporary layer, though they're no substitute for applying the vendor mitigation directly.
Published ·Deep Fathom