CISA added CVE-2026-42897, a cross-site scripting zero-day in Microsoft Exchange Server's Outlook Web Access (OWA), to its Known Exploited Vulnerabilities catalogue on Friday 15 May 2026 with a federal remediation deadline of Friday 29 May. The vulnerability scores CVSS 8.1. Microsoft had not shipped a patch at the time the deadline was issued; the only available mitigation was the Exchange Emergency Mitigation Service (EEMS) URL-rewrite rule. Active exploitation was confirmed against on-premises Exchange Server 2016, 2019, and Subscription Edition. Exchange Online is unaffected12.
CISA has now issued two deadline-before-patch rulings inside twelve days. The PAN-OS CVE-2026-0300 KEV addition on 6 May established the first such case, where Palo Alto's first patches shipped four days after CISA's federal deadline. Twelve days later, CISA repeated the move on Exchange. Binding Operational Directive 22-01, the 2021 instrument that gives the KEV catalogue federal force, was drafted on the assumption that remediation existed. Its text has not been amended to recognise mitigation as a compliance route, and Microsoft's own EEMS guidance carries documented side effects to OWA calendar, Light mode, and inline images. For federal civilian Chief Information Officers running on-premises Exchange, compliance now means accepting a degraded mail experience to satisfy a directive that does not formally contemplate the route they are taking.
Microsoft Intune, the company's mobile-device management product, has surfaced repeatedly in the 2026 KEV stream alongside its Exchange and OS estate. Outside the federal civilian executive branch the KEV is voluntary, but the ICO's Capita ruling treated NCSC guidance as enforceable GDPR baseline, and a US KEV deadline carries the same shape under UK and EU data-protection frameworks. The CISA directive may be federal in scope; its enforceability is now international by precedent.
