Skip to content
Briefings are running a touch slower this week while we rebuild the foundations.See roadmap
Cybersecurity: Threats and Defences
20MAY

Exchange repeats the CISA deadline-before-patch trap

3 min read
09:58UTC

CISA added Exchange Server CVE-2026-42897 to KEV on 15 May with a 29 May federal deadline before Microsoft had shipped a patch, leaving on-premises operators with only the Exchange Emergency Mitigation Service URL-rewrite as a compliance route.

TechnologyDeveloping
Key takeaway

Federal agencies must mitigate, not patch, Exchange OWA by 29 May under a directive that does not allow it.

CISA added CVE-2026-42897, a cross-site scripting zero-day in Microsoft Exchange Server's Outlook Web Access (OWA), to its Known Exploited Vulnerabilities catalogue on Friday 15 May 2026 with a federal remediation deadline of Friday 29 May. The vulnerability scores CVSS 8.1. Microsoft had not shipped a patch at the time the deadline was issued; the only available mitigation was the Exchange Emergency Mitigation Service (EEMS) URL-rewrite rule. Active exploitation was confirmed against on-premises Exchange Server 2016, 2019, and Subscription Edition. Exchange Online is unaffected 1 2.

CISA has now issued two deadline-before-patch rulings inside twelve days. The PAN-OS CVE-2026-0300 KEV addition on 6 May established the first such case, where Palo Alto's first patches shipped four days after CISA's federal deadline. Twelve days later, CISA repeated the move on Exchange. Binding Operational Directive 22-01, the 2021 instrument that gives the KEV catalogue federal force, was drafted on the assumption that remediation existed. Its text has not been amended to recognise mitigation as a compliance route, and Microsoft's own EEMS guidance carries documented side effects to OWA calendar, Light mode, and inline images. For federal civilian Chief Information Officers running on-premises Exchange, compliance now means accepting a degraded mail experience to satisfy a directive that does not formally contemplate the route they are taking.

Microsoft Intune, the company's mobile-device management product, has surfaced repeatedly in the 2026 KEV stream alongside its Exchange and OS estate. Outside the federal civilian executive branch the KEV is voluntary, but the ICO's Capita ruling treated NCSC guidance as enforceable GDPR baseline, and a US KEV deadline carries the same shape under UK and EU data-protection frameworks. The CISA directive may be federal in scope; its enforceability is now international by precedent.

Deep Analysis

In plain English

US government agencies were told on 15 May 2026 that they must fix a serious security flaw in Microsoft's email server software by 29 May. The catch: Microsoft had not released a fix yet. Agencies could only reduce the risk using a workaround that also broke some email features.

Deep Analysis
Root Causes

Microsoft's on-premises Exchange Server architecture accumulates complexity across three product versions, 2016, 2019, and Subscription Edition, with different patch cadences and mitigation compatibility profiles.

The Exchange Emergency Mitigation Service was introduced in 2021 as an emergency response to ProxyLogon, indicating Microsoft anticipated recurring zero-day exposure in the on-premises product; the EEMS approach trades functional degradation, OWA calendar, Light mode, and inline images, for rapid deployment without full patch testing.

The structural cause of repeat Exchange zero-days is the product's age and the depth of its Windows-kernel and IIS-pipeline integration, which creates a large attack surface that each new feature addition extends.

Exchange Online's immunity to CVE-2026-42897 reflects a different deployment model: Microsoft controls the infrastructure and applies mitigations centrally without customer action, illustrating that the on-premises exposure is partly an architectural legacy problem rather than purely a code quality issue.

First Reported In

Update #4 · AI joins the breach column on both sides

Cybersecurity and Infrastructure Security Agency· 20 May 2026
Read original
Causes and effects
This Event
Exchange repeats the CISA deadline-before-patch trap
Second deadline-before-patch ruling in twelve days. The pattern is now CISA posture rather than a one-off forced by exploitation velocity, and BOD 22-01's text has not been amended to acknowledge mitigation as compliance.
Different Perspectives
Tsinghua University Institute for International Strategic Studies
Tsinghua University Institute for International Strategic Studies
Beijing-aligned commentary rejects US attribution of PRC-nexus clusters (UNC2814, APT45, UAT-8616) as politically motivated framing, characterising the April sixteen-agency joint advisory as coordinated Western pressure rather than independent technical assessment.
Google Threat Intelligence Group
Google Threat Intelligence Group
GTIG's 11 May report establishes AI-assisted offence and AI-infrastructure targeting as concurrent named-incident categories, not theoretical ones: UNC6780 attacked LiteLLM and Cisco AI Defense in parallel; state actors used Gemini operationally; CANFAIL and LONGSTREAM used LLM-generated queries to evade static analysis.
Cisco
Cisco
Cisco has not confirmed the UNC6780 breach scope beyond the named AI Defense and AI Assistant projects; GitHub confirmed an investigation. CVE-2026-20182 is the sixth Cisco SD-WAN KEV entry in 2026, reaching that milestone the same week UNC6780's source-code visibility into the portfolio became public.
NCSC
NCSC
The ICO's South Staffs Water fine applies NCSC PAM and monitoring guidance as the GDPR Article 32 enforcement baseline against a water-sector CNI operator, extending the Capita precedent before the CS&R Bill has reached Royal Assent. NCSC guidance now carries enforceable weight inside the existing statutory framework for CNI sectors processing personal data.
Microsoft Security Response Center
Microsoft Security Response Center
The Exchange Emergency Mitigation Service URL rewrite is the sole available mitigation for CVE-2026-42897; MSRC has not signalled an out-of-band patch timeline. The workaround breaks OWA calendar print, inline images, and Light mode, forcing CISOs to choose between user-experience breakage and active-exploitation exposure.
CISA
CISA
CISA's Exchange CVE-2026-42897 deadline of 29 May, set before Microsoft published a patch, repeats the PAN-OS posture from 6 May: exploitation velocity now overrides vendor release timelines. BOD 22-01 compliance against an unpatched flaw leaves federal CISOs with only mitigation documentation and mailbox-rule monitoring.