Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
| 18 May 2026 | |
| Written by Gabi Gerber | |
| Attacks & Threats |
| Hacking Topics, Security Operation Center |
The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw. An anonymous researcher has been credited with discovering and reporting the issue.
"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network," the tech giant said in a Thursday advisory.
Microsoft, which tagged the vulnerability with an "Exploitation Detected" assessment, said an attacker could weaponize it by sending a crafted email to a user, which, when opened in Outlook Web Access and subject to other "certain interaction conditions," can allow arbitrary JavaScript code to be executed in the context of the web browser. More here
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links. More...
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, t… More...
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting… More...
Those closest to executives must match their security postures because the weakest link in a family can become the entry… More...
A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, includin… More...
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links. More...
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, t… More...
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting… More...
Those closest to executives must match their security postures because the weakest link in a family can become the entry… More...
A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, includin… More...
