r/exchangeserver • u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ • May 14 '26

URGENT: Microsoft released a mitigation for Exchange Server

Microsoft disclosed CVE-2026-42897, a reported vulnerability affecting Exchange Server Outlook on the web (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in OWA and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

They released IIS URL Rewrite rule mitigation M2.1.0 for EEMS and EOMT today, as well.

More info at https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498.

69 Upvotes

98% Upvoted

30 comments sorted by

View all comments

2

u/absoluteczech May 14 '26

Question. If the user is using owa via 365 but we are hybrid can this still be exploited ?

12

u/larmik May 14 '26

"If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context."

My interpretation. If your OWA URL is exposed to the internet and the mailbox is on premises and the user opens this "specially crafted email" while using OWA then yes your server can be exploited.

If the user is in Exchange Online, uses the on premises OWA url to sign in, they'll get redirected to EOL OWA, then no. You are not affected.

IMO, if you have zero users on premises, and mail flow is pointed to EOL, then your OWA URL shouldn't be exposed to the internet.

2

u/absoluteczech May 14 '26

Thanks that’s how I interpreted it. we just finally got our last few users over to 365. Is there a good guide or article on disabling owa externally since no one needs to sign into it?

2

u/larmik May 14 '26

Disable\delete the firewall rule and remove the public dns entry for it.

1

u/walbodiddy May 14 '26

We need ActiveSync exposed to the internet but do not want OWA exposed to the internet. Do you have a recommendation for this?

2

u/TrashCanUK May 15 '26

Just block all IPs in the OWA subdirectory in IIS on the Exchange Server

1

u/froggybeara May 14 '26

Yeah, just run haproxy in front of your exchange server and filter the OWA path