Detections
Analytics

Security Updates for Microsoft Exchange Server (May 2026)

medium Nessus Plugin ID 316010

Language:

Synopsis

The Microsoft Exchange Server installed on the remote host is affected by a spoofing vulnerability.

Description

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by a vulnerability as referenced in the May, 2026 security bulletin.

 - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. (CVE-2026-42897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Microsoft has released the following security updates to address this issue:
 -KB5011155
 -KB5035606
 -KB5042461

See Also

http://www.nessus.org/u?009684cc

http://www.nessus.org/u?89a21212

Plugin Details

Severity: Medium

ID: 316010

File Name: smb_nt_ms26_may_exchange.nasl

Version: 1.2

Type: Local

Agent: windows

Published: 5/21/2026

Updated: 5/22/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-42897

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:microsoft:exchange_server:2016, cpe:/a:microsoft:exchange_server:2019

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/14/2026

Vulnerability Publication Date: 5/14/2026

CISA Known Exploited Vulnerability Due Dates: 5/29/2026

Reference Information

CVE: CVE-2026-42897

MSFT: MS26-5011155, MS26-5035606, MS26-5042461

MSKB: 5011155, 5035606, 5042461