{"id":215268,"date":"2026-05-17T07:04:00","date_gmt":"2026-05-17T11:04:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/05\/17\/microsoft-confirms-active-0-day-exploit-check-emergency-mitigation\/"},"modified":"2026-05-18T04:25:21","modified_gmt":"2026-05-18T08:25:21","slug":"microsoft-confirms-active-0-day-exploit-check-emergency-mitigation","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/05\/17\/microsoft-confirms-active-0-day-exploit-check-emergency-mitigation\/","title":{"rendered":"Microsoft Confirms Active 0-Day Exploit\u2014Check Emergency Mitigation"},"content":{"rendered":"

Microsoft Confirms Active 0-Day Exploit\u2014Check Emergency Mitigation<\/a><\/p>\n

https:\/\/www.forbes.com\/sites\/daveywinder\/2026\/05\/17\/microsoft-exchange-active-0-day-exploit-enable-emergency-mitigation-now\/<\/a><\/p>\n

Publish Date: 2026-05-17 07:04:00<\/a><\/p>\n

Source Domain: www.forbes.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. Microsoft confirms Exchange zero-day, CISA warns it’s under active exploitation.gettyUpdated May 17: This article, originally published May 16, has been updated to include further details on the emergency mitigation process recommended after the CVE-2026-42897 Microsoft Exchange remote code execution zero-day was confirmed by the U.S. Cybersecurity and Infrastructure Security Agency as actively exploited by attackers. It\u2019s been something of a rough few days for Microsoft Exchange on the security vulnerability front. A zero-day being demonstrated at the Pwn2Own Berlin hacking event, which has been responsibly disclosed and not released into the wild. Definitely already out there, and under active exploitation according to the U.S. Cybersecurity and Infrastructure Security Agency, another Exchange zero-day, confirmed by Microsoft on May 14. CISA added the CVE-2026-42897 vulnerability to its Known Exploited Vulnerabilities Catalog on May 15, urging all organizations to prioritize timely remediation as the attack vector poses a significant risk. Here\u2019s what you need to know.ForbesMicrosoft Windows Alert\u2014Angry Hacker Drops 2 New Zero-Day ExploitsBy Davey WinderThe Microsoft Exchange CVE-2026-42897 Zero-Day ExplainedMicrosoft disclosed CVE-2026-42897 on May 14, describing the zero-day as a Microsoft Exchange Server spoofing vulnerability. Technically speaking, the vulnerability occurs when an improper neutralization of input during web page generation, or a cross-site scripting attack if you prefer, enables an attacker to perform spoofing over the network. All it takes to exploit this is to send a maliciously crafted email, which, when opened in Outlook Web Access, can execute arbitrary JavaScript in the context of the browser.”The disclosure of CVE-2026-42897 is a reminder that on-premises Exchange remains the most targeted piece of real estate in the enterprise stack,\u201d Damon Small, a director at Xcape, Inc., said, adding that \u201cthis zero-day allows unauthenticated remote code execution, effectively granting attackers a direct path to the heart of corporate identity and communications.\u201dExchange Online is not impacted by the zero-day, but the following on-premises Exchange Server versions are:Exchange Server 2016 (any update level)Exchange Server 2019 (any update level)Exchange Server Subscription Edition (SE) (any update level)ForbesMicrosoft Windows 11 Exploited 3 Times In 24 Hours By Zero-Day HackersBy Davey WinderMicrosoft has recommended mitigation via the Exchange Emergency Mitigation Service as the patch has already been published through it. \u201cUsing EM Service is the best way for your organization to mitigate this vulnerability right away,\u201d Microsoft said; \u201cIf you have EM Service currently disabled, we recommend you enable it right away.\u201dTo check the status of the Exchange Emergency Mitigation Service, organizations should run the Exchange Health Checker script provided by Microsoft. \u201cThe HTML report will include a section on EEMS check results,\u201d Microsoft has confirmed. This will also verify that your \u201cservers have applied the mitigation for CVE-2026-42897,\u201d Microsoft said, advising that M2.1.x is the relevant mitigation ID to look for.\u201cBecause a formal patch is still pending,\u201d Small wanred, \u201corganizations are forced into a mitigation-only posture, relying on the Emergency Mitigation Service to essentially apply a virtual band-aid to a critical wound.\u2019 The priority, therefore, must be immediate validation that the EM Service is actually functional and applying the necessary URI blocks as, \u201ca single misconfigured server can serve as the beachhead for a full domain compromise.\u201d Small also noted that this incident should be the catalyst to accelerate a move from Exchange Server to Microsoft Exchange Online in the enterprise, or, \u201cat the very least, to isolate these servers behind a zero-trust gateway.\u201d”Exchange remains one of the most dangerous places for a remote code execution flaw to land,\u201d Jacob Krell, senior director of secure AI solutions and Cybersecurity at Suzu Labs, said, as it \u201csits close to identity and inside the communication layer most organizations depend on every day.\u201d Krell also warned that \u201cattackers study mitigation guidance the same way defenders do,\u201d meaning that such vulnerabilities can be turned into working exploits \u201cmuch faster than most organizations can validate exposure.\u201d The message is clear, especially as it has now been confirmed by both CISA and Microsoft itself that attacks are already underway, that checking to ensure the Exchange Emergency Mitigation Service is enabled and the relevant mitigation ID for CVE-2026-42897 applied is not an option; it\u2019s a critical confirmation that your on-premises Microsoft Exchange Server is not at risk of being exploited.
<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft Confirms Active 0-Day Exploit\u2014Check Emergency Mitigation https:\/\/www.forbes.com\/sites\/daveywinder\/2026\/05\/17\/microsoft-exchange-active-0-day-exploit-enable-emergency-mitigation-now\/ Publish Date: 2026-05-17 07:04:00 Source Domain: www.forbes.com…<\/p>\n","protected":false},"author":1,"featured_media":215269,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imageio.forbes.com\/specials-images\/imageserve\/6a089505605e4fcb2a0a192a\/0x0.jpg?format=jpg&height=900&width=1600&fit=bounds","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,31,35,27],"class_list":["post-215268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-exploit","tag-hacker","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/215268"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=215268"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/215268\/revisions"}],"predecessor-version":[{"id":215270,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/215268\/revisions\/215270"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/215269"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=215268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=215268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=215268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}