What is a zero-day vulnerability?

A zero-day is a security flaw unknown to the software vendor — they have had zero days to patch it. Attackers exploit them freely until the vendor learns about the issue and releases a fix. Nation-state groups actively trade zero-days for hundreds of thousands of dollars.

Should I install software updates immediately?

Yes, especially for critical patches. Most real-world attacks exploit known vulnerabilities that already have patches. Enable automatic updates for your OS, browser, and security software. Wait 24-48 hours for major updates if concerned about first-day bugs, then install.

What is CVE and why does it matter?

CVE (Common Vulnerabilities and Exposures) assigns a unique ID to each documented flaw. Each CVE has a CVSS severity score from 0 to 10 — anything 9.0+ is critical. When a patch is released for a CVE, it means attackers know the details and exploitation attempts increase immediately.

Opening One Email in Microsoft Exchange Can Hand Hackers Your Entire Account — And There's Still No Fix

No Patch. Active Attacks. Your Email at Risk.

On May 14, 2026, Microsoft confirmed a zero-day vulnerability in Exchange Server — the email platform used by governments, hospitals, law firms, banks, and enterprises worldwide.

CVE-2026-42897 affects Exchange's Outlook Web Access (OWA) — the browser-based email interface that millions of users open every day. The attack is devastatingly simple: an attacker sends you a specially crafted email. You open it in your browser. Their code executes in your session. Game over.

Microsoft has no permanent patch. CISA added it to the Known Exploited Vulnerabilities catalog on May 15 and ordered federal agencies to patch by May 29. Security researchers have since demonstrated additional escalation paths.

If your organisation runs Exchange Server on-premises, this is an active emergency.

What the Vulnerability Does

OWA runs in your web browser. Like any web application, it executes JavaScript. CVE-2026-42897 exploits a failure to properly sanitise content in incoming emails — when the email is opened in OWA, attacker-controlled JavaScript runs inside your authenticated session.

What an attacker can do with that:

Read all your emails — every folder, every message, every attachment
Send emails as you — to your contacts, suppliers, executives, family
Export your contact list — names, numbers, internal organisation structure
Access shared mailboxes — in many organisations, one compromised account reaches finance, HR, legal
Pivot to other internal systems — OWA sessions often have access to calendar, SharePoint, Teams integrations

This isn't theoretical. Microsoft confirmed active exploitation in the wild before the advisory was even published.

Who Is Affected

Affected:

Organisations running Microsoft Exchange Server on-premises (2016, 2019, 2021)
Anyone using Outlook Web Access (browser-based email) on those servers
Hybrid deployments where on-premises Exchange connects to Microsoft 365

Not directly affected:

Microsoft 365 / Exchange Online cloud users (Microsoft manages patching)
Users accessing Exchange only via native desktop Outlook (not OWA)

The "No Permanent Patch" Problem

Microsoft's May 14 advisory included mitigations — configuration changes that reduce the attack surface — but no permanent fix.

Mitigations include:

Restricting OWA access to internal networks only (blocks external attacks but not insider threats)
Disabling specific rendering features in OWA
Enhanced email filtering rules

These reduce risk but don't eliminate it. Researchers at Pwn2Own demonstrated in May 2026 that some mitigation paths have gaps — combinations of the vulnerability with other Exchange components can still achieve code execution even with standard mitigations in place.

A permanent patch is expected in a future Cumulative Update. Timeline: unconfirmed.

What To Do Right Now

If you're an IT administrator:

Apply Microsoft's published mitigations immediately — find them in the CVE-2026-42897 advisory
Restrict OWA access to VPN/internal network access only until a patch is available
Enable enhanced logging on Exchange to detect exploitation attempts
Check your Exchange version and patch level — older versions may have additional exposure
Monitor CISA's KEV catalog for patch deadline updates

If you're an employee who uses OWA:

Ask your IT team whether your organisation's Exchange server has been patched or mitigated
Switch to the native Outlook desktop app instead of OWA until resolved
Be extra suspicious of unexpected emails — even from known senders
Report any unusual account activity (sent emails you didn't send, password change notices) immediately

If you're on Microsoft 365: You're not directly at risk from this specific vulnerability. But your on-premises Exchange-using contacts are — a compromised account can send convincing attacks to your inbox.

Why This Keeps Happening

Exchange Server is one of the most targeted pieces of enterprise software in the world. It sits at the centre of organisational communication, holds sensitive data across every department, and is deeply integrated into authentication and identity infrastructure.

It's also complex, expensive to maintain, and often managed by teams without dedicated security resources. Many organisations run Exchange Server versions that are months or years behind on patches.

This isn't the first critical Exchange zero-day. It won't be the last.

The recurring lesson: email infrastructure is critical infrastructure. It deserves the same security investment as your network perimeter.

Stay invisible. Follow HackDecoded.