Hackers are already exploiting a cross-site scripting flaw in Microsoft Exchange Server, leaving organisations running on-premises deployments scrambling.

Microsoft Exchange users are urged to mitigate a zero-day vulnerability that CISA has confirmed is under active exploitation.

CVE-2026-42897 stems from a cross-site scripting (XSS) vulnerability and can allow an attacker to compromise Outlook Web Access (OWA) mailboxes.

Hackers are already exploiting a cross-site scripting flaw in Microsoft Exchange Server, leaving organisations running on-premises deployments scrambling.