
A newly discovered zero-day vulnerability in Microsoft Exchange Server has experts sounding the alarm. On Thursday, Microsoft announced mitigations for a high-security Exchange Server vulnerability that's being actively exploited by hackers. All an attacker needs to do is send a specially crafted email that, when opened through Outlook Web Access, can execute arbitrary code within the user's browser.
Microsoft's called this security flaw (tracked as CVE-2026-42897) a spoofing vulnerability affecting fully updated versions of Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).