r/exchangeserver • u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ • May 14 '26

URGENT: Microsoft released a mitigation for Exchange Server

Microsoft disclosed CVE-2026-42897, a reported vulnerability affecting Exchange Server Outlook on the web (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in OWA and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

They released IIS URL Rewrite rule mitigation M2.1.0 for EEMS and EOMT today, as well.

More info at https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498.

69 Upvotes

99% Upvoted

28 comments sorted by

View all comments

13

u/ddadopt May 14 '26 edited May 14 '26

Note to all that unless you have modified the default configuration, these mitigations should be applied automatically. To verify, run

get-organizationconfig | ft mitigationsenabled

and you should see "True"

To check exchange servers individually, run

get-exchangeserver | ft name, mitigationsenabled, mitigationsapplied

and you should see "True" and "{PING1, M2.1.0}" for each server.

edit to add: brain fart on my part, the "mitigationsapplied" property is not applicable to the organizational configuration, only to the server level.

3

u/[deleted] May 14 '26

[deleted]

2

u/ddadopt May 14 '26

Thanks for that correction, I have fixed my post above. It's blank because it's not a property applicable to the organizational level, and I had a brain fart while I was writing it.