Microsoft Exchange Server 0-Day Vulnerability Exploited in Attacks Using Weaponized Email

Microsoft has confirmed active exploitation of a new zero‑day spoofing flaw in on‑premises Exchange Server, tracked as CVE‑2026‑42897. The flaw allows attackers to execute arbitrary JavaScript in Outlook Web Access (OWA) simply by sending a weaponized email that a victim opens in a browser. On May 14, 2026, Microsoft disclosed CVE‑2026‑42897 as a spoofing vulnerability […] The post Microsoft Exchange Server 0-Day Vulnerability Exploited in Attacks Using Weaponized Email appeared first on Cyber Security News.