Microsoft issues mitigation guidance for exploited Exchange zero-day

Microsoft has disclosed and provided mitigation guidance for a high-severity zero-day vulnerability in on-premises Microsoft Exchange Server that it said is being actively exploited. Tracked as CVE202642897 and rated 8.1, the flaw affects Exchange Outlook on the web for some organizations and allows attackers to execute malicious browser-side code after tricking a targeted user through a specially crafted email.

In an advisory issued May 14, Microsoft described the vulnerability as a spoofing and cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. According to Microsoft, an attacker can weaponize the flaw by sending a crafted message to a user; if the user opens the email in Outlook Web Access and certain interaction conditions are met, “arbitrary JavaScript can be executed in the browser context,” the Exchange Team said. Microsoft said Exchange Online, the cloud-hosted service, is not impacted.

The advisory covers all on-premises Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) versions. Microsoft has not yet released a permanent patch, but it urged administrators to use interim...