Exploitation Summary
CVE-2026-42897 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 15, 2026. EIP tracks 1 public exploit from researchers including atiilla.
AI-analyzed exploit summary This repository contains a functional proof-of-concept demonstrating CVE-2026-42897, a vulnerability in Microsoft Exchange Health Checker where outbound IIS URL Rewrite rules are not detected, leading to false negatives in mitigation verification. The PoC script simulates the vulnerable parsing logic and compares it with a patched version to highlight the blind spot.
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Exploits (1)
This repository contains a functional proof-of-concept demonstrating CVE-2026-42897, a vulnerability in Microsoft Exchange Health Checker where outbound IIS URL Rewrite rules are not detected, leading to false negatives in mitigation verification. The PoC script simulates the vulnerable parsing logic and compares it with a patched version to highlight the blind spot.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N