Microsoft has confirmed that the Exchange Server zero-day vulnerability, CVE-2026-42897, is being actively exploited. Disclosed on May 14, this spoofing vulnerability allows attackers to execute arbitrary JavaScript via a malicious email. On-premises versions of Exchange Server 2016, 2019, and Subscription Edition are affected; however, Exchange Online is safe.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urges organizations to prioritize remediation, as attackers are exploiting the vulnerability aggressively. Microsoft recommends using the Exchange Emergency Mitigation Service to address this issue, as no official patch is available yet.
Additionally, an “angry hacker” known as Chaotic Eclipse has released a zero-day exploit for Windows 11, allowing attackers to gain system privileges even on fully updated systems. This exploit revisits a vulnerability originally reported in 2020 but believed to be patched. Chaotic Eclipse claims Microsoft failed to address this issue properly, prompting the release of exploit details.
Organizations are advised to enable the Emergency Mitigation Service and verify that their systems are secure to prevent exploitation, as the threat landscape remains critical.
Source link
