Updated May 18: This article has been updated to include further details on the emergency mitigation process recommended by Microsoft after the CVE-2026-42897 Exchange Server zero-day was confirmed by the U.S. Cybersecurity and Infrastructure Security Agency as already being actively exploited in the wild by attackers. Alongside this, there is a second update concerning yet another zero-day exposure from an ‘angry hacker’ who has added to the long list of publicly disclosed vulnerabilities by posting details of a Windows 11 ‘proof of concept’ exploit that gives an attacker system privileges even when Windows is running fully patched and up to date..
It’s been something of a rough few days for Microsoft Exchange on the security vulnerability front. A zero-day being demonstrated at the Pwn2Own Berlin hacking event, which has been responsibly disclosed and not released into the wild. Definitely already out there, and under active exploitation according to the U.S. Cybersecurity and Infrastructure Security Agency, another Exchange zero-day, confirmed by Microsoft on May 14. CISA added the CVE-2026-42897 vulnerability to its Known Exploited Vulnerabilities Catalog on May 15, urging all organizations to prioritize timely remediation as the attack vector poses a significant risk. Here’s what you need to know.
The Microsoft Exchange CVE-2026-42897 Zero-Day Explained
Microsoft disclosed CVE-2026-42897 on May 14, describing the zero-day as a Microsoft Exchange Server spoofing vulnerability. Technically speaking, the vulnerability occurs when an improper neutralization of input during web page generation, or a cross-site scripting attack if you prefer, enables an attacker to perform spoofing over the network. All it takes to exploit this is to send a maliciously crafted email, which, when opened in Outlook Web Access, can execute arbitrary JavaScript in the context of the browser.
“The disclosure of CVE-2026-42897 is a reminder that on-premises Exchange remains the most targeted piece of real estate in the enterprise stack,” Damon Small, a director at Xcape, Inc., said, adding that “this zero-day allows unauthenticated remote code execution, effectively granting attackers a direct path to the heart of corporate identity and communications.”
Exchange Online is not impacted by the zero-day, but the following on-premises Exchange Server versions are:
- Exchange Server 2016 (any update level)
- Exchange Server 2019 (any update level)
- Exchange Server Subscription Edition (SE) (any update level)
Microsoft Says Check Exchange Server Emergency Mitigation Statistics Now
Microsoft has recommended mitigation via the Exchange Emergency Mitigation Service as the patch has already been published through it. “Using EM Service is the best way for your organization to mitigate this vulnerability right away,” Microsoft said; “If you have EM Service currently disabled, we recommend you enable it right away.”
To check the status of the Exchange Emergency Mitigation Service, organizations should run the Exchange Health Checker script provided by Microsoft. “The HTML report will include a section on EEMS check results,” Microsoft has confirmed. This will also verify that your “servers have applied the mitigation for CVE-2026-42897,” Microsoft said, advising that M2.1.x is the relevant mitigation ID to look for.
“Because a formal patch is still pending,” Small warned, “organizations are forced into a mitigation-only posture, relying on the Emergency Mitigation Service to essentially apply a virtual band-aid to a critical wound.’ The priority, therefore, must be immediate validation that the EM Service is actually functional and applying the necessary URI blocks as, “a single misconfigured server can serve as the beachhead for a full domain compromise.” Small also noted that this incident should be the catalyst to accelerate a move from Exchange Server to Microsoft Exchange Online in the enterprise, or, “at the very least, to isolate these servers behind a zero-trust gateway.”
“Exchange remains one of the most dangerous places for a remote code execution flaw to land,” Jacob Krell, senior director of secure AI solutions and Cybersecurity at Suzu Labs, said, as it “sits close to identity and inside the communication layer most organizations depend on every day.” Krell also warned that “attackers study mitigation guidance the same way defenders do,” meaning that such vulnerabilities can be turned into working exploits “much faster than most organizations can validate exposure.” The message is clear, especially as it has now been confirmed by both CISA and Microsoft itself that attacks are already underway, that checking to ensure the Exchange Emergency Mitigation Service is enabled and the relevant mitigation ID for CVE-2026-42897 applied is not an option; it’s a critical confirmation that your on-premises Microsoft Exchange Server is not at risk of being exploited.
Angry Microsoft Windows Hacker Releases Yet Another Zero-Day Exploit
It’s not just Microsoft Exchange that is having a bad time with regard to zero-day vulnerabilities. As I have previously reported, a hacker with a grudge against the way Microsoft Security Response Center has dealt with their vulnerability reports, known as Chaotic Eclipse, has been publicly disclosing Windows zero-day exploits for some weeks now. The latest, which has been given the designation of MiniPlasma, impacts users of Windows 11 and was published on May 16, enabling a successful attacker to gain system privileges even on an up-to-date and fully security-patched machine.
Chaotic Eclipse appears to have an issue with the way that the Microsoft Security Response Center has treated him, and has said that “I was told personally by them that they will ruin my life and they did,” and that “they mopped the floor with me and pulled every childish game they could. It was so bad at some point I was wondering if I was dealing with a massive corporation or someone who is just having fun seeing me suffer, but it seems to be a collective decision.”
The zero-day actually exploits a vulnerability first reported in September 2020, by James Forshaw from the Google Project Zero research team. Officially labeled as CVE-2020-17103, the vulnerability was thought to have been patched by Microsoft in December the same year. Chaotic Eclipse, however, re-investigated the technique used in the GreenPlasma exploit they recently disclosed, and said that the same issue “is actually still present, unpatched.” As a result, the hacker said that to “highlight this issue, I weaponized the original PoC to spawn a SYSTEM shell.” Tests have shown that this certainly works on a fully patched Windows 11 Pro system, and Chaotic Eclipse warned that “I believe all Windows versions are affected by this vulnerability.” At the time of publication, there is no available advice on mitigating this issue, other than to wait for Microsoft to address it with an updated patch, as far as I am aware. I have reached out to Microsoft for a statement.
