CVE-2026-42897

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
May 15, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-428989.9Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute cCVE-2026-428997.5Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-42909.1The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST APCVE-2026-429008.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attaCVE-2026-4290110.0Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-429027.8Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.CVE-2026-429036.5Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.CVE-2026-429049.6Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-429057.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-429065.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.CVE-2026-429076.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a netCVE-2026-429087.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
CVE-2026-42897: Medium severity, CVSS 6.1 | Vulnix