CISA added CVE-2026-42897, a Microsoft Exchange Server cross-site scripting vulnerability affecting Outlook Web Access on on-premises Exchange, to its Known Exploited Vulnerabilities Catalog on May 15, 2026, after evidence showed the flaw was being actively exploited in real-world attacks. The...