CVE-2026-42897
HIGH
CVSS: 8.1
EPSS: 71.2%
VulnCheck KEV
PoC Available
CWE-79
T1189
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Published: 2026-05-14