{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Microsoft heeft een kwetsbaarheid verholpen in Microsoft Exchange Server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid betreft een cross-site scripting (XSS) probleem dat ontstaat door onjuiste neutralisatie van invoer tijdens het genereren van webpagina\u0027s. Een onbevoegde aanvaller kan hierdoor kwaadaardige scripts injecteren en spoofing-aanvallen uitvoeren over een netwerk. Dit komt doordat gebruikersinvoer onvoldoende wordt gesanitiseerd voordat deze in webpagina\u0027s wordt weergegeven. Misbruik van deze kwetsbaarheid kan leiden tot ongeautoriseerde acties binnen de context van de getroffen webapplicatie. De kwetsbaarheid treft specifiek Microsoft Exchange Server omgevingen waar de invoerafhandeling niet adequaat is beveiligd.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Microsoft heeft, in afwachting van een definitieve oplossing, mitigerende maatregelen geimplementeerd in de Exchange Emergency Mitigation Service middels een out-of-band update. Deze service is standaard actief. Microsoft adviseert om voor de zekerheid te controleren of deze service daadwerkelijk actief is op de eigen Exchange Server. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Microsoft Exchange Server",
    "tracking": {
      "current_release_date": "2026-05-15T08:41:41.607495Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0159",
      "initial_release_date": "2026-05-15T08:41:41.607495Z",
      "revision_history": [
        {
          "date": "2026-05-15T08:41:41.607495Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Exchange Server 2016 Cumulative Update 23"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Exchange Server 2019 Cumulative Update 14"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Exchange Server 2019 Cumulative Update 15"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Exchange Server Subscription Edition RTM"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42897",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "A cross-site scripting vulnerability in Microsoft Exchange Server allows unauthorized attackers to perform network-based spoofing by improperly neutralizing input during web page generation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-42897 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42897.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-42897"
    }
  ]
}

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
    }
  ],
  "id": "CVE-2026-42897",
  "lastModified": "2026-05-14T18:19:50.767",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "secure@microsoft.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-05-14T18:16:49.360",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T18:16:49Z",
    "severity": "HIGH"
  },
  "details": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.",
  "id": "GHSA-3c39-338m-m4vp",
  "modified": "2026-05-14T18:32:57Z",
  "published": "2026-05-14T18:32:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42897"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 15",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 15",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server Subscription Edition RTM",
      "product": {
        "name": "Exchange Server Subscription Edition RTM",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 14",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 14",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 23",
      "product": {
        "name": "Exchange Server 2016 Cumulative Update 23",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": null,
  "content": "## Contournement provisoire\n\nLe service de contournement d\u0027urgence pour Exchange (*Exchange Emergency Mitigation Service*) [1] est activ\u00e9 par d\u00e9faut et fonctionne automatiquement. Pour les environnements d\u00e9connect\u00e9s, l\u0027\u00e9diteur a mis \u00e0 disposition un billet de blogue [2] d\u00e9taillant une proc\u00e9dure pour appliquer le contournement provisoire.\n\n## Solutions\nMicrosoft a annonc\u00e9 qu\u0027un correctif sera publi\u00e9 prochainement.\nLe CERT-FR recommande de consulter r\u00e9guli\u00e8rement les annonces de l\u0027\u00e9diteur pour la mise \u00e0 disposition des correctifs.",
  "cves": [
    {
      "name": "CVE-2026-42897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897"
    }
  ],
  "initial_release_date": "2026-05-15T00:00:00",
  "last_revision_date": "2026-05-15T00:00:00",
  "links": [
    {
      "title": "Compromission d\u0027un compte de messagerie - Qualification",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-003/"
    },
    {
      "title": "Compromission d\u0027un compte de messagerie - Endiguement",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-004/"
    },
    {
      "title": "[1] Service de contournement d\u0027urgence pour Exchange",
      "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service"
    },
    {
      "title": "[2] Billet de blogue de l\u0027\u00e9quipe Exchange",
      "url": "https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498"
    },
    {
      "title": "Avis CERT-FR CERTFR-2026-AVI-0599 du 15 mai 2026",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0599/"
    }
  ],
  "reference": "CERTFR-2026-ALE-005",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Le 14 mai 2026, Microsoft a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la vuln\u00e9rabilit\u00e9 CVE-2026-42897 affectant Exchange Server. Elle permet \u00e0 un attaquant non authentifi\u00e9 de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9 lorsqu\u0027un utilisateur ouvre un courriel pi\u00e9g\u00e9 dans Outlook Web Access.\n\nMicrosoft indique que la vuln\u00e9rabilit\u00e9 CVE-2026-42897 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Exchange Server",
  "vendor_advisories": [
    {
      "published_at": "2026-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42897",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Anonymous"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
      },
      {
        "category": "self",
        "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-42897.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Exchange Server Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2026-05-14T07:00:00.000Z",
      "generator": {
        "date": "2026-05-14T16:59:34.945Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-42897",
      "initial_release_date": "2026-05-12T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-14T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42897",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.\nThe Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default.  If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service.  You can find more information and instruction in the Exchange blog here.\nMicrosoft is supplying a temporary mitigation for this vulnerability through the Exchange Emergency Mitigation Service.  We are working on developing and testing a more permanent fix which we will provide when it meets our quality standards.",
          "title": "How could an attacker exploit this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12039",
          "12293",
          "12502",
          "16792"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
        },
        {
          "category": "self",
          "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-42897.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "FUNCTIONAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected"
        }
      ],
      "title": "Microsoft Exchange Server Spoofing Vulnerability"
    }
  ]
}