CVE-2026-42897

KEV High · CVSS 8.1

Microsoft Exchange Server — Cross-Site Scripting (XSS) leading to spoofing

CVSS: 8.1; nvd
EPSS: —
KEV: Listed; 2026-05-15
Class: other; CWE-79

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Search profile — drives PoC discovery

Symbols CVE-2026-42897Exchange Server XSSimproper neutralizationweb page generationspoofing over networkCWE-79

Keywords CVE-2026-42897Microsoft Exchange ServerXSScross-site scriptingspoofingExchange spoofingExchange XSS PoCExchange Server vulnerability 2026MSRC CVE-2026-42897CWE-79 Exchange

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

atiilla/CVE-2026-42897 needs review

recent activity

gh_search · PowerShell

★ 4

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-06-16T00:00:58.000Z · profiled 2026-06-16T18:20:23.035Z