Vulnerability-Lookup

CERTFR-2026-ALE-005

Vulnerability from certfr_alerte - Published: 2026-05-15 - Updated: 2026-07-13

[Mise à jour du 11 juin 2026]

Le 9 juin 2026, Microsoft a publié des versions correctives.

[Publication initiale]

Le 14 mai 2026, Microsoft a publié un avis de sécurité concernant la vulnérabilité CVE-2026-42897 affectant Exchange Server. Elle permet à un attaquant non authentifié de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité lorsqu'un utilisateur ouvre un courriel piégé dans Outlook Web Access.

Microsoft indique que la vulnérabilité CVE-2026-42897 est activement exploitée.

Contournement provisoire

Le service de contournement d'urgence pour Exchange (Exchange Emergency Mitigation Service) [1] est activé par défaut et fonctionne automatiquement. Pour les environnements déconnectés, l'éditeur a mis à disposition un billet de blogue [2] détaillant une procédure pour appliquer le contournement provisoire.

Solutions

Microsoft a annoncé qu'un correctif sera publié prochainement. Le CERT-FR recommande de consulter régulièrement les annonces de l'éditeur pour la mise à disposition des correctifs.

Impacted products

Vendor	Product	Description
Microsoft	Exchange Server 2019 Cumulative Update 15	Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft	Exchange Server Subscription Edition RTM	Microsoft Exchange Server Subscription Edition RTM
Microsoft	Exchange Server 2019 Cumulative Update 14	Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft	Exchange Server 2016 Cumulative Update 23	Microsoft Exchange Server 2016 Cumulative Update 23

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft CVE-2026-42897	2026-05-14	vendor-advisory
Compromission d'un compte de messagerie - Qualification	-	other
Compromission d'un compte de messagerie - Endiguement	-	other
[1] Service de contournement d'urgence pour Exchange	-	other
[2] Billet de blogue de l'équipe Exchange	-	other
Avis CERT-FR CERTFR-2026-AVI-0599 du 15 mai 2026	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 15",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 15",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server Subscription Edition RTM",
      "product": {
        "name": "Exchange Server Subscription Edition RTM",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 14",
      "product": {
        "name": "Exchange Server 2019 Cumulative Update 14",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 23",
      "product": {
        "name": "Exchange Server 2016 Cumulative Update 23",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": null,
  "content": "## Contournement provisoire\n\nLe service de contournement d\u0027urgence pour Exchange (*Exchange Emergency Mitigation Service*) [1] est activ\u00e9 par d\u00e9faut et fonctionne automatiquement. Pour les environnements d\u00e9connect\u00e9s, l\u0027\u00e9diteur a mis \u00e0 disposition un billet de blogue [2] d\u00e9taillant une proc\u00e9dure pour appliquer le contournement provisoire.\n\n## Solutions\nMicrosoft a annonc\u00e9 qu\u0027un correctif sera publi\u00e9 prochainement.\nLe CERT-FR recommande de consulter r\u00e9guli\u00e8rement les annonces de l\u0027\u00e9diteur pour la mise \u00e0 disposition des correctifs.",
  "cves": [
    {
      "name": "CVE-2026-42897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897"
    }
  ],
  "initial_release_date": "2026-05-15T00:00:00",
  "last_revision_date": "2026-07-13T00:00:00",
  "links": [
    {
      "title": "Compromission d\u0027un compte de messagerie - Qualification",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-003/"
    },
    {
      "title": "Compromission d\u0027un compte de messagerie - Endiguement",
      "url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-004/"
    },
    {
      "title": "[1] Service de contournement d\u0027urgence pour Exchange",
      "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service"
    },
    {
      "title": "[2] Billet de blogue de l\u0027\u00e9quipe Exchange",
      "url": "https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498"
    },
    {
      "title": "Avis CERT-FR CERTFR-2026-AVI-0599 du 15 mai 2026",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0599/"
    }
  ],
  "reference": "CERTFR-2026-ALE-005",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-15T00:00:00.000000"
    },
    {
      "description": "Le 9 juin 2026, Microsoft a publi\u00e9 des versions correctives.",
      "revision_date": "2026-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "[Mise \u00e0 jour du 11 juin 2026]\n\nLe 9 juin 2026, Microsoft a publi\u00e9 des versions correctives.\n\n[Publication initiale]\n\nLe 14 mai 2026, Microsoft a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la vuln\u00e9rabilit\u00e9 CVE-2026-42897 affectant Exchange Server. Elle permet \u00e0 un attaquant non authentifi\u00e9 de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9 lorsqu\u0027un utilisateur ouvre un courriel pi\u00e9g\u00e9 dans Outlook Web Access.\n\nMicrosoft indique que la vuln\u00e9rabilit\u00e9 CVE-2026-42897 est activement exploit\u00e9e.",
  "title": "[M\u00e0j] Vuln\u00e9rabilit\u00e9 dans Microsoft Exchange Server",
  "vendor_advisories": [
    {
      "published_at": "2026-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42897",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
    }
  ]
}

CVE-2026-42897 (GCVE-0-2026-42897)

Vulnerability from cvelistv5 – Published: 2026-05-14 17:00 – Updated: 2026-08-10 15:14

Title

Microsoft Exchange Server Spoofing Vulnerability

Summary

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 4926 records in the last 180 days details

References

2 references

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

4 products

Vendor	Product	Version
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	Affected: 15.01.0.0 , < 15.01.2507.069 (custom)
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	Affected: 15.02.0.0 , < 15.02.1544.041 (custom)
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	Affected: 15.02.0.0 , < 15.02.1748.046 (custom)
Microsoft	Microsoft Exchange Server Subscription Edition RTM	Affected: 15.02.0.0 , < 15.02.2562.043 (custom)

Date Public

2026-05-14 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42897",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T03:55:55.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-15T00:00:00.000Z",
            "value": "CVE-2026-42897 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2507.069",
              "status": "affected",
              "version": "15.01.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 14",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1544.041",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 15",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1748.046",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.2562.043",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionEndExcluding": "15.01.2507.069",
                  "versionStartIncluding": "15.01.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1544.041",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1748.046",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.2562.043",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-05-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T15:14:02.885Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"
        }
      ],
      "title": "Microsoft Exchange Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-42897",
    "datePublished": "2026-05-14T17:00:36.515Z",
    "dateReserved": "2026-04-30T22:35:54.967Z",
    "dateUpdated": "2026-08-10T15:14:02.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted