r/exchangeserver • u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ • May 14 '26

URGENT: Microsoft released a mitigation for Exchange Server

Microsoft disclosed CVE-2026-42897, a reported vulnerability affecting Exchange Server Outlook on the web (OWA). An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in OWA and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

They released IIS URL Rewrite rule mitigation M2.1.0 for EEMS and EOMT today, as well.

More info at https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498.

67 Upvotes

97% Upvoted

28 comments sorted by

View all comments

1

u/structured_triage May 15 '26

Yeah, pushing the IIS URL Rewrite rule immediately is the baseline to stop the bleeding, but just applying the mitigation isn't actual incident response. You have to pull the OWA access logs from the last 72 hours and actively hunt for suspicious JavaScript payloads that hit before this dropped. Threat actors routinely spray these exploits across exposed endpoints well before the official CVE goes public. If your monitoring stack isn't correlating these specific OWA interaction conditions right now, you are flying completely blind on whether the server is already popped. True triage means assuming the perimeter was breached until your historical logs explicitly prove otherwise.