CVE-2026-42897

CVE-2026-42897 is a spoofing flaw in Microsoft Exchange Server rated High at CVSS 8.8. It affects on-premises Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14, and Exchange Server 2019 Cumulative Update 15, so shops still running these specific CU levels are in scope. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-15, meaning exploitation against real targets has been confirmed rather than theorized. There is no known ransomware association at this time, and the EPSS score sits at 20 percent, which understates the practical risk given the confirmed-exploited status. For a spoofing bug in Exchange, the concern is an attacker convincing a mail client or downstream system that a forged message or identity is legitimate, which supports phishing and lateral movement inside a mail environment.

Do this: Confirm your exact Exchange build. If you are on 2016 CU23, 2019 CU14, or 2019 CU15, apply the Microsoft security update for CVE-2026-42897 without waiting for a maintenance window, since CISA lists it as actively exploited. After patching, verify the update actually installed on every Exchange role and confirm the version string moved. Because this is confirmed exploited, review mail flow and authentication logs for spoofing indicators around and before the patch date, and treat unpatched internet-facing Exchange as an active exposure until updated.

AI-generated from public data, 2026-07-25. Verify against the vendor advisory before acting.