CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-05-14
Microsoft Exchange Server Cross-Site Scripting (XSS) and Spoofing Vulnerability Advisory (CVE-2026-42897)
[Affected Scope] All supported on-premises Microsoft Exchange Server environments.
[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.
[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.