Forbes | Davey Winder
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical Microsoft Exchange zero-day vulnerability, CVE-2026-42897, adding it to its Known Exploited Vulnerabilities Catalog. This spoofing vulnerability, affecting on-premises Exchange Server versions (2016, 2019, Subscription Edition) but not Exchange Online, allows unauthenticated remote code execution when a maliciously crafted email is opened in Outlook Web Access. Microsoft recommends immediate mitigation via its Exchange Emergency Mitigation Service (EEMS), urging organizations to enable and validate its functionality, specifically checking for mitigation ID M2.1.x. Experts warn that a pending formal patch forces a mitigation-only posture, making prompt EEMS validation crucial to prevent full domain compromise. This incident underscores the inherent risks of on-premises Exchange and advocates for accelerated migration to Exchange Online or the implementation of zero-trust gateways to secure enterprise communications.