{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Anonymous"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
      },
      {
        "category": "self",
        "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-42897.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Exchange Server Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2026-06-09T07:00:00.000Z",
      "generator": {
        "date": "2026-06-09T18:07:33.353Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-42897",
      "initial_release_date": "2026-05-12T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-14T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-05-18T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated FAQ information. This is an informational change only."
        },
        {
          "date": "2026-06-09T07:00:00.000Z",
          "legacy_version": "2",
          "number": "3",
          "summary": "Added links to June 2026 Exchange Server security updates.  Microsoft recommends installing this updates as soon as possible."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.01.2507.069",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.069",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "15.01.2507.069",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.069",
              "product_id": "12039"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2016 Cumulative Update 23"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1544.041",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 14 \u003c15.02.1544.041",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1544.041",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.041",
              "product_id": "12293"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 14"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1748.046",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 15 \u003c15.02.1748.046",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1748.046",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.046",
              "product_id": "12502"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 15"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.2562.043",
            "product": {
              "name": "Microsoft Exchange Server Subscription Edition RTM \u003c15.02.2562.043",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.2562.043",
            "product": {
              "name": "Microsoft Exchange Server Subscription Edition RTM 15.02.2562.043",
              "product_id": "16792"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server Subscription Edition RTM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42897",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.\nThe Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default.  If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service.  You can find more information and instruction in the Exchange blog here.\nNo, because Content Security Policy (CSP) is not supported by Internet Explorer nor Microsoft Edge using Internet Explorer Mode. To stay protected, please make sure to not use Internet Explorer (Mode) to access OWA.\nMicrosoft is supplying a temporary mitigation for this vulnerability through the Exchange Emergency Mitigation Service.  We are working on developing and testing a more permanent fix which we will provide when it meets our quality standards.\nMicrosoft recommends installing the June 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability.\nAs part of our ongoing efforts to strengthen security and improve defenses across environments, we continue to enhance protections for cross-site scripting attacks. We recommend that customers keep the mitigation describe in place. The mitigation provides an additional layer of defense and helps ensure continuous protection as further improvements are released. Additional updates will be shared as they become available. Please see the exchange blog post for more information.",
          "title": "How could an attacker exploit this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12039",
          "12293",
          "12502",
          "16792"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
        },
        {
          "category": "self",
          "summary": "CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-42897.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-14T07:00:00.000Z",
          "details": "15.01.2507.069:Security Update:https://support.microsoft.com/help/5094144",
          "product_ids": [
            "4"
          ],
          "url": "https://support.microsoft.com/help/5094144"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-14T07:00:00.000Z",
          "details": "15.02.1544.041:Security Update:https://support.microsoft.com/help/5094142",
          "product_ids": [
            "3"
          ],
          "url": "https://support.microsoft.com/help/5094142"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-14T07:00:00.000Z",
          "details": "15.02.1748.046:Security Update:https://support.microsoft.com/help/5094140",
          "product_ids": [
            "2"
          ],
          "url": "https://support.microsoft.com/help/5094140"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-14T07:00:00.000Z",
          "details": "15.02.2562.043:Security Update:https://support.microsoft.com/help/5094139",
          "product_ids": [
            "1"
          ],
          "url": "https://support.microsoft.com/help/5094139"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "FUNCTIONAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected"
        }
      ],
      "title": "Microsoft Exchange Server Spoofing Vulnerability"
    }
  ]
}