Microsoft Exchange Server: Schwachstelle ermöglicht Cross-Site-Scripting- und Spoofing-Angriffe
WID-SEC-2026-1536 · first 15.05.2026 · updated 11.06.2026 · CVSS 8,1
What it is about
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft Exchange Server ausnutzen, um Cross-Site-Scripting- und Spoofing-Angriffe durchzuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Cross-Site-Scripting-
- Spoofing-Angriffe durchzuführen
Am I affected?
Affected according to the BSI:
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Microsoft Exchange Server Subscription Edition RTM
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
- CVE-2026-42897: exploited in the wild according to CISA, in the catalogue since 15.05.2026.
Information and sources
- Original BSI advisory (WID)
- Microsoft Leitfaden für Sicherheitsupdates msrc.microsoft.com
- Microsoft Security Update CVE-2026-42897 vom 2026-05-14 msrc.microsoft.com
CVE: CVE-2026-42897
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.