ANDROID Redmi K100 confirmed for October 27 launch with 165Hz display and Snapdragon 8 Elite ACCESSORIES Thanko launches USB-powered heated gaming gloves for around $22 ACCESSORIES Godox A2 brings 1/8,000s sync xenon flash to iPhones for around $85 AMD Lenovo ThinkCentre M75t Gen 6 adds Radeon RX 6400 graphics in Eurozone, UK, and Singapore GAMES Arkham Horror The Card Game Second Season Gets Blood Token Mechanics in New Russia-Exclusive Campaign DLSS Super Meat Boy 3D update adds DLSS and FSR support alongside crossover character GAMES Mass Effect Legendary Edition multiplayer restored by community mod with 66 characters and 19 maps INTEL Xiaomi Redmi Book 16 2027 swaps Core Ultra for Wildcat Lake Core 5 320 for better battery life ACCESSORIES WALLHACK SP-005 Berserk glass mousepad launches worldwide for $139 GAMES Cosplayer Maria Davydova Brings Baldur’s Gate 3’s Dark Urge to Life in Dark Fantasy Photoshoot STEAM Cleaner Company launches January 26 with four-player co-op sci-fi cleaning chaos STEAM Taskey’s Midnight Toybox turns a child’s bedroom into a deadly board game GAMES The FINALS update makes the announcer call out your actual player name AYN ODIN Ayn Odin 3 Portal handheld features 9,000mAh battery and Snapdragon Q8 for extended emulation

Microsoft Exchange Server Zero-Day CVE-2026-42897 Exploited via Crafted Email

Owen Carter 1 min read

Microsoft confirms active exploitation of CVE-2026-42897, a zero-day XSS vulnerability in on-premises Exchange Server. Emergency mitigation deployed; no permanent patch yet. CISA adds to KEV catalog.

Microsoft Exchange Server Zero-Day CVE-2026-42897 Exploited via Crafted Email
SOFTWARE AND UPDATES

Microsoft has confirmed active exploitation of a zero-day vulnerability in on-premises Exchange Server. The flaw, tracked as CVE-2026-42897, allows attackers to execute arbitrary JavaScript in a victim's browser by sending a crafted email. No permanent patch is available yet.

Zero-day XSS flaw in OWA

The vulnerability is a cross-site scripting issue in the Outlook Web Access component, rated CVSS 8.1. It affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition at any update level. Exchange Online is not vulnerable.

Microsoft deployed an emergency mitigation on May 14 through the Exchange Emergency Mitigation Service, labeled M2.1.x. The mitigation disables the OWA Print Calendar feature, inline images, and the OWA Light interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 15 and requires federal agencies to remediate by May 29.

Microsoft is developing a permanent fix but has not confirmed a release timeline. The company has not identified the threat actors behind the attacks or disclosed which organizations were targeted.

Source: NotebookCheck

Related stories