Microsoft warns of Exchange zero-day flaw exploited in attacks

Microsoft disclosed CVE-2026-42897, a high-severity spoofing/XSS vulnerability in Exchange Server 2016, 2019, and Subscription Edition that is being exploited in the wild to execute arbitrary JavaScript when victims open specially crafted emails in Outlook on the web; Microsoft recommends enabling the Exchange Emergency Mitigation Service (EEMS) or applying the Exchange on‑premises Mitigation Tool (EOMT) as temporary protections while patches are prepared, noting mitigation side-effects and limited patch availability for some older supported releases.