Vulnerability-Lookup

CERTFR-2026-ALE-005

Vulnerability from certfr_alerte - Published: 2026-05-15 - Updated: 2026-05-15

Le 14 mai 2026, Microsoft a publié un avis de sécurité concernant la vulnérabilité CVE-2026-42897 affectant Exchange Server. Elle permet à un attaquant non authentifié de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité lorsqu'un utilisateur ouvre un courriel piégé dans Outlook Web Access.

Microsoft indique que la vulnérabilité CVE-2026-42897 est activement exploitée.

Contournement provisoire

Le service de contournement d'urgence pour Exchange (Exchange Emergency Mitigation Service) [1] est activé par défaut et fonctionne automatiquement. Pour les environnements déconnectés, l'éditeur a mis à disposition un billet de blogue [2] détaillant une procédure pour appliquer le contournement provisoire.

Solutions

Microsoft a annoncé qu'un correctif sera publié prochainement. Le CERT-FR recommande de consulter régulièrement les annonces de l'éditeur pour la mise à disposition des correctifs.

Impacted products

Vendor	Product	Description
Microsoft	Exchange Server 2019 Cumulative Update 15	Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft	Exchange Server Subscription Edition RTM	Microsoft Exchange Server Subscription Edition RTM
Microsoft	Exchange Server 2019 Cumulative Update 14	Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft	Exchange Server 2016 Cumulative Update 23	Microsoft Exchange Server 2016 Cumulative Update 23

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft CVE-2026-42897	2026-05-14	vendor-advisory
Compromission d'un compte de messagerie - Qualification	-	other
Compromission d'un compte de messagerie - Endiguement	-	other
[1] Service de contournement d'urgence pour Exchange	-	other
[2] Billet de blogue de l'équipe Exchange	-	other
Avis CERT-FR CERTFR-2026-AVI-0599 du 15 mai 2026	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 15",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 15",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server Subscription Edition RTM",
      "product": {
        "name": "Exchange Server Subscription Edition RTM",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 14",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 14",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 23",
      "product": {
        "name": "Exchange Server 2016 Cumulative Update 23",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": null,
  "content": "## Contournement provisoire\n\nLe service de contournement d\u0027urgence pour Exchange (*Exchange Emergency Mitigation Service*) [1] est activ\u00e9 par d\u00e9faut et fonctionne automatiquement. Pour les environnements d\u00e9connect\u00e9s, l\u0027\u00e9diteur a mis \u00e0 disposition un billet de blogue [2] d\u00e9taillant une proc\u00e9dure pour appliquer le contournement provisoire.\n\n## Solutions\nMicrosoft a annonc\u00e9 qu\u0027un correctif sera publi\u00e9 prochainement.\nLe CERT-FR recommande de consulter r\u00e9guli\u00e8rement les annonces de l\u0027\u00e9diteur pour la mise \u00e0 disposition des correctifs.",
  "cves": [
    {
      "name": "CVE-2026-42897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897"
    }
  ],
  "initial_release_date": "2026-05-15T00:00:00",
  "last_revision_date": "2026-05-15T00:00:00",
  "links": [
    {
      "title": "Compromission d\u0027un compte de messagerie - Qualification",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-003/"
    },
    {
      "title": "Compromission d\u0027un compte de messagerie - Endiguement",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-004/"
    },
    {
      "title": "[1] Service de contournement d\u0027urgence pour Exchange",
      "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service"
    },
    {
      "title": "[2] Billet de blogue de l\u0027\u00e9quipe Exchange",
      "url": "https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498"
    },
    {
      "title": "Avis CERT-FR CERTFR-2026-AVI-0599 du 15 mai 2026",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0599/"
    }
  ],
  "reference": "CERTFR-2026-ALE-005",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Le 14 mai 2026, Microsoft a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la vuln\u00e9rabilit\u00e9 CVE-2026-42897 affectant Exchange Server. Elle permet \u00e0 un attaquant non authentifi\u00e9 de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9 lorsqu\u0027un utilisateur ouvre un courriel pi\u00e9g\u00e9 dans Outlook Web Access.\n\nMicrosoft indique que la vuln\u00e9rabilit\u00e9 CVE-2026-42897 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Exchange Server",
  "vendor_advisories": [
    {
      "published_at": "2026-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42897",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
    }
  ]
}

CVE-2026-42897 (GCVE-0-2026-42897)

Vulnerability from cvelistv5 – Published: 2026-05-14 17:00 – Updated: 2026-05-16 03:55

Title

Microsoft Exchange Server Spoofing Vulnerability

Summary

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch

Impacted products

4 products

Vendor	Product	Version
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	Affected: -
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	Affected: -
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	Affected: -
Microsoft	Microsoft Exchange Server Subscription Edition RTM	Affected: -

Date Public ?

2026-05-14 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42897",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T03:55:55.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-15T00:00:00.000Z",
            "value": "CVE-2026-42897 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 14",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 15",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "-"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*",
                  "versionStartIncluding": "-",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-05-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T17:13:44.533Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
        }
      ],
      "title": "Microsoft Exchange Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-42897",
    "datePublished": "2026-05-14T17:00:36.515Z",
    "dateReserved": "2026-04-30T22:35:54.967Z",
    "dateUpdated": "2026-05-16T03:55:55.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted