CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。 攻击者通过发送特制邮件，当受害者使用Outlook on the web打开时，即可在受害者的浏览器会话中执行恶意JavaScript，实现欺骗或在会话中执行未经授权的操作。
What should organizations running on-premises Microsoft Exchange Server know about the actively exploited CVE-2026-42897 zero-day, includingThe Exchange Server zero‑day CVE‑2026‑42897 targets Outlook on the web in on‑premises deployments and is already being exploited.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What should organizations running on-premises Microsoft Exchange Server know about the actively exploited CVE-2026-42897 zero-day, including. Article summary: Organizations running on-premises Exchange should treat CVE-2026-42897 as urgent because it is an actively exploited OWA cross-site scripting vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition, . Topic tags: general, government, general web. Reference image context from search candidates: Reference image 1: visual subject "# Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897) Hits On-Premises Exchange Servers. Outlook Web Access Exploit CVE-2026-42897 Exchange Server. A newly disclosed" source context "Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897 ..." Reference image 2: visual subject "On May 14, 202
openai.com
微软于2026年5月14日披露了CVE-2026-42897，并警告该漏洞已被用于针对运行本地部署Microsoft Exchange Server的组织的实际攻击。此漏洞影响Outlook on the web (OWA)组件，攻击者可以利用一个跨站脚本(XSS)弱点，在受害者的浏览器会话中进行欺骗和潜在的恶意操作。
CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。
首先要验证的关键点是什么？
CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。 攻击者通过发送特制邮件，当受害者使用Outlook on the web打开时，即可在受害者的浏览器会话中执行恶意JavaScript，实现欺骗或在会话中执行未经授权的操作。
CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。 攻击者通过发送特制邮件，当受害者使用Outlook on the web打开时，即可在受害者的浏览器会话中执行恶意JavaScript，实现欺骗或在会话中执行未经授权的操作。
What should organizations running on-premises Microsoft Exchange Server know about the actively exploited CVE-2026-42897 zero-day, includingThe Exchange Server zero‑day CVE‑2026‑42897 targets Outlook on the web in on‑premises deployments and is already being exploited.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What should organizations running on-premises Microsoft Exchange Server know about the actively exploited CVE-2026-42897 zero-day, including. Article summary: Organizations running on-premises Exchange should treat CVE-2026-42897 as urgent because it is an actively exploited OWA cross-site scripting vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition, . Topic tags: general, government, general web. Reference image context from search candidates: Reference image 1: visual subject "# Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897) Hits On-Premises Exchange Servers. Outlook Web Access Exploit CVE-2026-42897 Exchange Server. A newly disclosed" source context "Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897 ..." Reference image 2: visual subject "On May 14, 202
openai.com
微软于2026年5月14日披露了CVE-2026-42897，并警告该漏洞已被用于针对运行本地部署Microsoft Exchange Server的组织的实际攻击。此漏洞影响Outlook on the web (OWA)组件，攻击者可以利用一个跨站脚本(XSS)弱点，在受害者的浏览器会话中进行欺骗和潜在的恶意操作。
CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。
首先要验证的关键点是什么？
CVE 2026 42897是一个正被野外积极利用的跨站脚本漏洞，影响本地部署的Exchange Server 2016、2019及订阅版(SE)的Outlook on the web组件；微软已发布临时缓解措施而非永久补丁。 攻击者通过发送特制邮件，当受害者使用Outlook on the web打开时，即可在受害者的浏览器会话中执行恶意JavaScript，实现欺骗或在会话中执行未经授权的操作。
