Microsoft Exchange Server
Microsoft's on-premises enterprise mail server; CVE-2026-42897 became the first KEV-listed Exchange flaw patched sixteen days after its federal Deadline.
Microsoft patched CVE-2026-42897, an Outlook Web Access flaw in Exchange Server, on 9 June 2026, 16 days after the 29 May Deadline CISA had set for federal agencies when it listed the zero-day as exploited on 15 May.
Last refreshed: 12 October 2026 · Appears in 1 active topic
What does the Exchange patch arriving sixteen days late mean for the BOD 22-01 compliance model?
Timeline for Microsoft Exchange Server
Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesReceived the overdue patch for CVE-2026-42897 OWA spoofing flaw on 9 June
Cybersecurity: Threats and Defences: 200 fixes, six zero-days, late ExchangeExchange repeats the CISA deadline-before-patch trap
Cybersecurity: Threats and DefencesBackground
Microsoft Exchange Server is Microsoft's on-premises mail and calendar server, shipped since version 4.0 in 1996 and now sold as Exchange Server 2016, 2019 and Subscription Edition. It remains common in government, healthcare and finance, where some organisations cannot move mail to Microsoft's hosted Exchange Online.
Its internet-facing web components make it a recurring target. ProxyLogon (CVE-2021-26855, rated 9.8) and ProxyShell in 2021, then ProxyNotShell in 2022, each drew mass exploitation before most servers were patched. The 2026 Outlook Web Access flaw repeated the pattern, and on 8 October 2026 a ten-agency advisory described China-linked operators password-spraying Exchange servers, trying a few common passwords against many accounts.
For defenders, that history means an Exchange flaw listed as exploited is an emergency by default. The 2026 case added a further lesson: a federal Deadline can fall before the vendor ships any fix, leaving a mitigation as the only option.
Exchange's deadline arrived before its patch
CISA added CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access rated 8.1, to its exploited-vulnerabilities list on 15 May with a 29 May deadline, though Microsoft had no patch. The only sanctioned stopgap was the Exchange Emergency Mitigation Service's URL-rewrite rule, which broke calendar printing, Light mode and inline images in Outlook Web Access. It was the second federal Deadline in twelve days set before a vendor fix existed.
The fix arrived in the 9 June Patch Tuesday, among roughly 200 flaws Microsoft addressed that day. Binding Operational Directive 22-01 requires remediation and does not name mitigation as a substitute, so agencies that applied the workaround stayed technically non-compliant for 11 days. Microsoft's hosted Exchange Online service never carried the flaw.