Exploited Vulnerabilities DailyCVE-2026-42897: Microsoft Microsoft
EPSS0.5%No. 1719 of 1739 in KEV
CVE year2026listed the same year
Same vendor in KEV389
Same product1
| Field | Value |
|---|---|
| Vendor | Microsoft |
| Product | Microsoft |
| Name | Microsoft Exchange Server Cross-Site Scripting Vulnerability |
| Added to KEV | 2026-05-15 |
| US federal due date | 2026-05-29 |
| Ransomware use | Unknown |
| CWE | CWE-79 |
CISA description
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Microsoft Microsoft vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-15.