{"history":[{"alert":0,"cve":"CVE-2026-42897","id":23438,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.70662, \"percentile\": 0.99403}"},{"alert":0,"cve":"CVE-2026-42897","id":20758,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.70662, \"percentile\": 0.99399}"},{"alert":0,"cve":"CVE-2026-42897","id":18759,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.70662, \"percentile\": 0.99398}"},{"alert":0,"cve":"CVE-2026-42897","id":16830,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.70662, \"percentile\": 0.99398}"},{"alert":0,"cve":"CVE-2026-42897","id":14808,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.70662, \"percentile\": 0.99398}"},{"alert":0,"cve":"CVE-2026-42897","id":12595,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.70662, \"percentile\": 0.99397}"},{"alert":0,"cve":"CVE-2026-42897","id":10579,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.70662, \"percentile\": 0.99396}"},{"alert":0,"cve":"CVE-2026-42897","id":8129,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.70662, \"percentile\": 0.99395}"},{"alert":0,"cve":"CVE-2026-42897","id":5908,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.70662, \"percentile\": 0.99395}"},{"alert":1,"cve":"CVE-2026-42897","id":3848,"kind":"cna","observed_at":1793701200,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-42897\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-05-14T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-05-15\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-05-16T03:55:55.096Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-15T00:00:00.000Z\", \"value\": \"CVE-2026-42897 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"platforms\": [\"x64-based Systems\"], \"product\": \"Microsoft Exchange Server 2016 Cumulative Update 23\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"15.01.2507.069\", \"status\": \"affected\", \"version\": \"15.01.0.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 14\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"15.02.1544.041\", \"status\": \"affected\", \"version\": \"15.02.0.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 15\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"15.02.1748.046\", \"status\": \"affected\", \"version\": \"15.02.0.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Microsoft Exchange Server Subscription Edition RTM\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"15.02.2562.043\", \"status\": \"affected\", \"version\": \"15.02.0.0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*\", \"versionEndExcluding\": \"15.01.2507.069\", \"versionStartIncluding\": \"15.01.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*\", \"versionEndExcluding\": \"15.02.1544.041\", \"versionStartIncluding\": \"15.02.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*\", \"versionEndExcluding\": \"15.02.1748.046\", \"versionStartIncluding\": \"15.02.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*\", \"versionEndExcluding\": \"15.02.2562.043\", \"versionStartIncluding\": \"15.02.0.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-05-14T14:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-10T15:14:02.885Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"Microsoft Exchange Server Spoofing Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897\"}], \"title\": \"Microsoft Exchange Server Spoofing Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-42897\", \"datePublished\": \"2026-05-14T17:00:36.515Z\", \"dateReserved\": \"2026-04-30T22:35:54.967Z\", \"dateUpdated\": \"2026-08-10T15:14:02.885Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2026-42897","id":3596,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.70662, \"percentile\": 0.99393}"},{"alert":1,"cve":"CVE-2026-42897","id":175,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-42897\", \"cwes\": [\"CWE-79\"], \"dateAdded\": \"2026-05-15\", \"dueDate\": \"2026-05-29\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897\", \"product\": \"Microsoft\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.\", \"vendorProject\": \"Microsoft\", \"vulnerabilityName\": \"Microsoft Exchange Server Cross-Site Scripting Vulnerability\"}"}],"record":{"affected":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2016 Cumulative Update 23","vendor":"Microsoft","versions":[{"lessThan":"15.01.2507.069","status":"affected","version":"15.01.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2019 Cumulative Update 14","vendor":"Microsoft","versions":[{"lessThan":"15.02.1544.041","status":"affected","version":"15.02.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2019 Cumulative Update 15","vendor":"Microsoft","versions":[{"lessThan":"15.02.1748.046","status":"affected","version":"15.02.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.043","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-42897","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-14T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-05-15","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-05-16T03:55:55.096Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"}],"timeline":[{"lang":"en","time":"2026-05-15T00:00:00.000Z","value":"CVE-2026-42897 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2016 Cumulative Update 23","vendor":"Microsoft","versions":[{"lessThan":"15.01.2507.069","status":"affected","version":"15.01.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2019 Cumulative Update 14","vendor":"Microsoft","versions":[{"lessThan":"15.02.1544.041","status":"affected","version":"15.02.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server 2019 Cumulative Update 15","vendor":"Microsoft","versions":[{"lessThan":"15.02.1748.046","status":"affected","version":"15.02.0.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.043","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*","versionEndExcluding":"15.01.2507.069","versionStartIncluding":"15.01.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*","versionEndExcluding":"15.02.1544.041","versionStartIncluding":"15.02.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*","versionEndExcluding":"15.02.1748.046","versionStartIncluding":"15.02.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*","versionEndExcluding":"15.02.2562.043","versionStartIncluding":"15.02.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-05-14T14:00:00.000Z","descriptions":[{"lang":"en-US","value":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-10T15:14:02.885Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"Microsoft Exchange Server Spoofing Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"}],"title":"Microsoft Exchange Server Spoofing Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-42897","datePublished":"2026-05-14T17:00:36.515Z","dateReserved":"2026-04-30T22:35:54.967Z","dateUpdated":"2026-08-10T15:14:02.885Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794111601,"cve":"CVE-2026-42897","description":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","epss":{"date":"2026-11-12","epss":0.70662,"percentile":0.99403},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2026-42897","cwes":["CWE-79"],"dateAdded":"2026-05-15","dueDate":"2026-05-29","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897","product":"Microsoft","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft Exchange Server Cross-Site Scripting Vulnerability"},"kev_checked":1794522003,"products":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Microsoft Exchange Server Subscription Edition RTM","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897"],"score":{"baseScore":8.1,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Microsoft Exchange Server Spoofing Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}