cve-2026-42897

CVE-2026-42897 is a Microsoft Exchange Server spoofing vulnerability affecting Outlook Web Access (OWA) in on-premises Exchange Server 2016, 2019, and Subscription Edition. Disclosed in May 2026, it was addressed through the Exchange Emergency Mitigation Service or the Exchange On-premises Mitigation Tool rather than a conventional patch. The June 2026 Exchange Security Updates included additional fixes for this CVE, emphasizing that Exchange patching now requires lifecycle discipline. Administrators must verify mitigation M2 is applied, as the vulnerability targets identity presentation in email and webmail, increasing phishing and fraud risks. Discussions on WindowsForum cover the disclosure, mitigation steps, and the broader implications for Exchange security management.