Microsoft patches exploited Exchange Server flaw that targets Outlook Web Access users

Microsoft released its June 2026 security updates on June 9 with a fix for CVE-2026-42897, an Exchange Server spoofing vulnerability that enables cross-site scripting attacks against Outlook Web Access (OWA) users, BleepingComputer reported. A remote, unauthenticated attacker sends a crafted email; if the recipient opens it in OWA under certain conditions, attacker JavaScript runs in their browser session. CISA had already added the flaw to its Known Exploited Vulnerabilities list on May 15, and Microsoft pushed a temporary mitigation through the Exchange Emergency Mitigation Service (EEMS) in mid-May. Exchange Server 2016, 2019 and Subscription Edition are affected.

On-premises Exchange remains a frequent target. BleepingComputer noted that CISA has added 20 Exchange vulnerabilities to its exploited list over five years, and ransomware groups have used 14 of them. Exchange 2016 and 2019 are also past end of support, which means organizations still running them are depending on an aging platform for a business-critical service.

If you run Exchange on-premises, confirm the June 2026 security update is installed on every server and that the EEMS mitigation remains enabled; Microsoft recommends keeping it as an extra layer after patching. Ask your IT provider for a server-by-server status, not a general answer.

Longer term, this is a good moment to price out the options: moving to Exchange Server Subscription Edition, moving mailboxes to a hosted service, or a hybrid design. The right answer depends on compliance needs and budget, but the cost of staying on unsupported versions keeps rising.