CVE-2026-42897KEV · OVERDUECWE-79

Microsoft Exchange Server Spoofing Vulnerability

High · published May 14, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 43.3th percentile for exploit probability.

147
days past CISA
deadline
CVSS v3.1
8.1
EPSS
1%
Percentile
43.3
In the wild
Confirmed
What it is

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-14T17:00Z
KEV added
2026-05-15 · due 2026-05-29
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 72% → 1%
    epss
  • 15 MAY 00:00Z
    Added to CISA KEV — remediate by May 29
    kev
  • 14 MAY 17:00Z
    Microsoft Exchange Server Spoofing Vulnerability
    cvelistv5