TL;DR: CVE-2026-42897 is an actively exploited XSS / spoofing vulnerability in Exchange Server’s Outlook Web Access (OWA). An attacker sends a specially crafted email; when the victim opens it in OWA, attacker-supplied JavaScript executes in the browser. Microsoft released the permanent patch as KB5094139 on June 9, 2026 (Exchange SE, 2019 CU14/CU15, 2016 CU23). Important: Exchange 2016 and 2019 patches require an ESU (Extended Security Update) Period 2 subscription. For those who cannot patch, EEMS (Exchange Emergency Mitigation Service) automatically applies temporary mitigation.

Which version gets what?

Exchange Version	SU/CU	KB	ESU Required?
Exchange Server SE (Subscription Edition)	RTM SU	KB5094139	❌ No (continuous update)
Exchange Server 2019 CU15	SU3	KB5094139	✅ Yes (ESU Period 2)
Exchange Server 2019 CU14	SU8	KB5094139	✅ Yes (ESU Period 2)
Exchange Server 2016 CU23	SU15	KB5094139	✅ Yes (ESU Period 2)
Exchange Server 2013 or older	—	No patch	EOL — migration required

Method 1 — Patching Exchange Server SE (RTM)

Subscription Edition users don’t need ESU; you can install the patch directly.

1. Download the SU package from Microsoft Update Catalog: https://catalog.update.microsoft.com → search KB5094139 → .msp for Exchange Server SE
2. RDP to the server and open elevated PowerShell
3. If DAG member: StartDagServerMaintenance.ps1 -ServerName <server>
4. Install SU: .Exchange2019-KB5094139-x64-en.msp /quiet
5. After restart, verify service state: Get-Service *exch* | Where Status -ne Running
6. Exit DAG mode: StopDagServerMaintenance.ps1 -ServerName <server>
7. Health tests: Test-MapiConnectivity, Test-OutlookWebServices

Method 2 — Exchange 2019 / 2016 (ESU Period 2)

Mainstream support has ended; you cannot install the patch without an ESU Period 2 license. If you don’t have one:

• Obtain ESU Y2 license key from Volume Licensing Service Center (VLSC)
• Activate: slmgr.vbs /ipk <ESU_KEY> then slmgr.vbs /ato
• Verify: slmgr.vbs /dlv shows ESU license status

After ESU activation, install the SU using Method 1 steps.

Method 3 — EEMS for those who can’t patch

Exchange Emergency Mitigation Service (EEMS) automatically applies rule sets pushed via Microsoft Defender ATP. EEMS mitigation for CVE-2026-42897 was pushed in May 2026 — if not enabled, enable manually:

# Check EEMS status
Get-OrganizationConfig | Select-Object MitigationsEnabled, MitigationsApplied

# Enable if inactive
Set-OrganizationConfig -MitigationsEnabled $true

# List applied mitigations
Get-ExchangeServer | Get-Mailbox | Select-Object MitigationsApplied
Get-MitigationsApplied

Important: EEMS is only temporary mitigation. The permanent solution is the KB5094139 patch.

Post-patch verification

# Check Exchange Build version
Get-ExchangeServer | Select-Object Name, AdminDisplayVersion

# Test OWA URL response
Invoke-WebRequest -Uri https://mail.contoso.com/owa -UseBasicParsing | Select StatusCode

# Service state
Get-Service MSExchange* | Format-Table Name, Status -AutoSize

# Health Mailbox integrity
Test-MapiConnectivity -Server <exch> | Where Result -ne Success

# Mail flow test (send to self)
Test-Mailflow -TargetMailboxServer <exch>

Exploitation detection — was I affected?

• Check OWA log files for suspicious JavaScript injection attempts: %ExchangeInstallPath%LoggingHttpProxyOwa
• IIS log analysis: C:inetpublogsLogFilesW3SVC* — look for <script>, onerror=, javascript: patterns in POST requests
• Mailbox rules: any new Outlook rules (forwarding, delete) on user accounts are suspicious
• Unexpected actions from privileged sessions: Get-AdminAuditLogConfig
• If suspicious, force MFA reset on users and revoke sessions: Revoke-AzureADUserAllRefreshToken

Common issues

• “SU install says ‘wrong CU level’.” Need to upgrade to required CU first. CU upgrade is bigger work than SU — DAG offline, schema update, etc.
• “Apple Mail incompatible after OWA patch.” ActiveSync session refresh may help; user deletes device profile and re-adds.
• “EEMS mitigation can’t install — Defender not found.” ATP integration requires EXO connectivity. Get-OrganizationConfig should have EEMSEndpointEnabled = true.
• “OWA login page is blank.” Try iisreset /noforce. If that fails, Update-OwaVDirVirtualDirectory.

Long-term recommendation: move to SE or Exchange Online

• Exchange Server 2016 mainstream support ended in 2025; 2019 ended in October 2025 — both are extended support only with ESU paid
• Exchange Server SE (Subscription Edition) is continuously updated, no ESU needed
• Exchange Online (M365) runs without patching — Microsoft manages it automatically; most sustainable mid-term choice
• Plan migration to SE or cloud within 2-3 years; firefighting every Patch Tuesday isn’t sustainable for small organizations

Sources: Microsoft MSRC, BleepingComputer, Messageware, Practical 365 analyses. Tested environments: Exchange 2019 CU14/CU15, Exchange SE RTM. Last updated: 2026-06-15.