CVE-2026-42897
ENISA EUVD: EUVD-2026-30343 ↗
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: July 14, 2026
21 articles
Published: 2026-05-14
EPSS Score
Source: FIRST.org · 2026-05-31
8.82%
probability
This CVE has a 8.82% probability
of being exploited in the next 30 days.
0%
Top 92.7th percentile of all CVEs
100%
CVSS v3.1
Source: VulnerabilityLookup (CIRCL)8.1
HIGH
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Temporal
Exploit Code Maturity
Functional
Remediation Level
Official Fix
Report Confidence
Confirmed
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Description
VulnerabilityLookup (CNA)Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Affected Products
Microsoft
Microsoft Exchange Server 2016 Cumulative Update 23
-
Microsoft
Microsoft Exchange Server 2019 Cumulative Update 14
-
Microsoft
Microsoft Exchange Server 2019 Cumulative Update 15
-
Microsoft
Microsoft Exchange Server Subscription Edition RTM
-
Google Project Zero
Patched
May 14, 2026
Reported by
Anonymous
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
vendor-advisory
patch
Signal Intelligence
Confidence
95%
EPSS
8.82%
CVSS v3.1
8.1
Mentions
21
Last Seen
Jun 11, 2026
CNA Information
CNA Assigner
microsoft
CNA Title
Microsoft Exchange Server Spoofing Vulnerability
Analyst Note
Auto-confirmed: présent dans Google Project Zero
Triage Info
Decided atJul 14, 2026
Published DateMay 14, 2026