Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
| 18 May 2026 | |
| Written by Gabi Gerber | |
| Attacks & Threats |
| Hacking Topics, Security Operation Center |
The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue.
"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network," the tech giant said in a Thursday advisory.
Microsoft, which tagged the vulnerability with an "Exploitation Detected" assessment, said an attacker could weaponize it by sending a crafted email to a user, which, when opened in Outlook Web Access and subject to other "certain interaction conditions," can allow arbitrary JavaScript code to be executed in the context of the web browser. More here
An untold number of ZBT routers sold around the world as white-label products come with several implants built by the manufacturer. More...
The latest version of the Android malware has new features that expand its global reach and put more than users' financi… More...
The new AI security controls follow the Hugging Face incident last month, though experts say many of these additions sho… More...
A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potentia… More...
A spear-phishing campaign by a China-nexus group linked to FamousSparrow provides insight into geopolitical, technical, … More...
An untold number of ZBT routers sold around the world as white-label products come with several implants built by the manufacturer. More...
The latest version of the Android malware has new features that expand its global reach and put more than users' financi… More...
The new AI security controls follow the Hugging Face incident last month, though experts say many of these additions sho… More...
A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potentia… More...
A spear-phishing campaign by a China-nexus group linked to FamousSparrow provides insight into geopolitical, technical, … More...
