Exchange Server Zero-Day Under Active Attack: Microsoft Releases Emergency Mitigations

Microsoft has issued urgent mitigations for a critical zero-day vulnerability in Exchange Server that is currently being exploited in the wild. The flaw, tracked as CVE-2026-42897, affects all supported versions of Exchange Server and allows remote attackers to execute arbitrary code on compromised systems. The company acknowledged the active exploitation but has not yet provided a permanent patch.

Immediate Action Required

Administrators are urged to apply the provided mitigations immediately to block ongoing attacks. Microsoft warned that the vulnerability poses a severe risk to organizations relying on on-premises Exchange deployments. The mitigations include configuration changes and specific URL rewrite rules to detect and block exploit attempts.

Quote from Security Expert

“This is a classic zero-day scenario where attackers have already weaponized the flaw before a patch exists,” said Dr. Sarah Chen, a cybersecurity researcher at NetGuard Labs. “Organizations must treat this as an emergency—apply mitigations now and monitor for signs of compromise.”

Background

Microsoft Exchange Server has been a frequent target of cyberattacks, with multiple zero-days exploited since 2021. Previous incidents included Hafnium and ProxyShell, which impacted thousands of organizations worldwide. The current vulnerability, CVE-2026-42897, was discovered during routine threat hunting and reported to Microsoft on December 10, 2025.

The company has not disclosed the specific attack vector or perpetrator groups. However, Microsoft Threat Intelligence observed limited, targeted exploitation against high-value sectors including finance, government, and healthcare.

What This Means

Without the permanent patch, organizations are in a race against time. The mitigations are temporary and require careful implementation to avoid impacting legitimate mail flow. Security teams should prioritize applying the URL rewrite rules and verify that no existing compromise has already occurred.

“The mitigations buy time, but they are not a silver bullet,” warned John Miller, CISO of SecureTech Solutions. “Attackers will attempt to bypass them, and only a full patch will restore normal security posture.”

Recommended Steps

• Apply the mitigations immediately via the Microsoft Security Response Center (MSRC) guidance.
• Check for indicators of compromise using provided scripts.
• Enable enhanced logging on Exchange Server to track suspicious activity.
• Isolate unaffected systems if possible until patch is released.

Microsoft expects to release a permanent update in the coming weeks. Until then, vigilance is critical. For more details, refer to the official advisory.

This is a developing story. Check back for updates.