Microsoft confirms active exploitation of Exchange Server zero-day


CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-day

Pierluigi Paganini
May 15, 2026

Microsoft warned that attackers are exploiting a new Exchange Server zero-day vulnerability, tracked as CVE-2026-42897, in the wild.

Microsoft warned that threat actors are actively exploiting a new Exchange Server zero-day vulnerability tracked as CVE-2026-42897 (CVSS score 8.1).

The vulnerability is an improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange Server. An attacker can exploit the flaw to perform spoofing over a network.

“Improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.” reads the advisory.

Microsoft warned that the Exchange Server zero-day affects Outlook Web Access (OWA). Attackers can exploit the flaw by sending a specially crafted email that executes malicious JavaScript when opened in Outlook Web Access under certain conditions.

Microsoft confirmed it had detected active exploitation of CVE-2026-42897 in the wild; however, it has not disclosed details about any attacks exploiting the issue.

Until a permanent security update becomes available, Microsoft has released temporary mitigation measures and urged administrators to apply them immediately to reduce exposure to attacks.

The flaw surfaced just two days after Microsoft’s Patch Tuesday for May 2026 updates, which patched 138 vulnerabilities.

Exchange Server zero-days are dangerous because they sit at the center of corporate email, one of the most sensitive and widely used systems in any organization.

Upon exploiting Microsoft Exchange Server flaws, attackers often get a direct path into internal communications, credentials, and business workflows.

A key reason they’re high risk is exposure. Many Exchange servers, especially on-premises deployments, are internet-facing. A zero-day means attackers can exploit the flaw before a patch exists, leaving defenders with no direct fix, only temporary mitigations.

OWA (Outlook Web Access) makes things worse. If a vulnerability works through the browser, attackers can use simple phishing-style emails to trigger it. In some cases, just opening an email in Outlook on the web can be enough to run malicious code in the user’s session.

Once attackers compromise Exchange, attackers can access emails and attachments, steal credentials, reset passwords, move into other systems, and maintain long-term access using mail rules or tokens.

Finally, Exchange zero-days are frequently targeted in cyber espionage campaigns and ransomware campaigns because they provide high-value access with relatively low noise.

In April, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability, tracked as CVE-2023-21529, to its Known Exploited Vulnerabilities (KEV) catalog.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Exchange Server)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews



In short: Accel has raised $5 billion in new capital, comprising a $4 billion Leaders Fund V and a $650 million sidecar, targeting 20-25 late-stage AI investments at an average cheque size of $200 million. The raise follows standout returns from its Anthropic stake (invested at $183B, now valued near $800B) and Cursor (backed at $9.9B, now reportedly around $50B), and lands in a Q1 2026 venture market that deployed a record $297 billion.

Accel, the venture capital firm behind early bets on Facebook, Slack, and more recently Anthropic and Cursor, has raised $5 billion in new capital aimed squarely at AI. The raise, reported by Bloomberg, comprises $4 billion for its fifth Leaders Fund and a $650 million sidecar vehicle, positioning the firm to write average cheques of around $200 million into late-stage AI companies globally.

The fund lands in a venture capital market that has lost any pretence of restraint. Q1 2026 saw $297 billion flow into startups worldwide, 2.5 times the total from Q4 2025 and the most venture funding ever recorded in a three-month period. Andreessen Horowitz has raised $15 billion. Thrive Capital has closed more than $10 billion. Founders Fund is finishing a $6 billion raise. Accel’s $5 billion is substantial but not exceptional in a market where the biggest funds are measured in the tens of billions.

The portfolio that made the pitch

What distinguishes Accel’s fundraise is the portfolio it can point to. The firm invested in Anthropic during its Series G at a $183 billion valuation. Anthropic has since closed a round at $380 billion and is now attracting offers at roughly $800 billion, meaning Accel’s stake has more than quadrupled in value in a matter of months. Anthropic’s annualised revenue has hit $30 billion, a trajectory that no company in history has matched.

The firm’s bet on Cursor has been similarly well-timed. Accel backed the AI code editor in June 2025 at a $9.9 billion valuation. By November, Cursor had raised again at $29.3 billion. By March 2026, the company was reportedly in discussions at a valuation of around $50 billion. For a developer tool that barely existed two years ago, the appreciation is extraordinary.

Accel’s broader AI portfolio extends beyond these two headline positions. The firm has backed Vercel, the frontend deployment platform; n8n, an AI-powered automation tool; Recraft, a professional design platform; and Code Metal, which builds AI development tools for hardware and defence applications. In March 2026, Accel launched an Atoms AI programme in partnership with Google’s AI Futures Fund, selecting five early-stage companies from what it described as a global applicant pool focused on “white space” opportunities in enterprise AI.

The Leaders Fund model

Accel’s Leaders Fund series is designed for later-stage investments, the kind of large cheques that growth-stage AI companies now require. With an average investment size of $200 million and a target of 20 to 25 deals from the new $4 billion fund, the strategy is concentrated: a small number of high-conviction bets on companies that have already demonstrated product-market fit and are scaling revenue.

This is a different game from traditional venture capital. At $200 million per cheque, Accel is competing less with seed and Series A firms and more with the mega-funds, sovereign wealth funds, and corporate investors that have flooded into late-stage AI. The firm’s argument is that its early-stage relationships and technical evaluation capabilities give it an edge in identifying which companies deserve capital at scale, and in securing allocations in rounds that are massively oversubscribed.

Founded in 1983 by Arthur Patterson and Jim Swartz, Accel built its reputation on what the founders called the “prepared mind” approach, a philosophy of deep sector research before investments materialise. The firm’s most famous prepared-mind bet was its 2005 investment of $12.7 million for 10% of Facebook, a stake worth $6.6 billion at the company’s IPO seven years later. The question now is whether Accel’s AI bets will produce returns of comparable magnitude.

What the market is pricing

The sheer volume of capital flowing into AI venture funds reflects a market consensus that artificial intelligence will be the dominant technology platform of the next decade. The numbers are difficult to overstate. OpenAI raised $120 billion in 2026. Anthropic has raised more than $50 billion. xAI closed $20 billion. Waymo secured $16 billion. These are not venture-scale numbers; they are infrastructure-scale capital deployments that would have been unthinkable outside of telecommunications or energy a decade ago.

For limited partners, the investors who commit capital to venture funds, the logic is straightforward: the returns from AI’s winners will be so large that even paying premium valuations will generate exceptional multiples. Accel’s Anthropic position, where a single investment has appreciated several times over in months, is exactly the kind of outcome that makes LPs willing to commit $5 billion to a single firm’s next fund.

The risk is equally visible. Venture capital is a cyclical business, and the current fundraising boom has the characteristics of a cycle peak: record fund sizes, compressed deployment timelines, and a concentration of capital in a single sector. The last time venture capital raised this aggressively, during the 2021 ZIRP era, many of those investments were marked down significantly within two years. AI’s commercial traction is far stronger than the crypto and fintech bets that defined that earlier cycle, but the valuations being paid today leave little margin for error.

The concentration question

Accel’s fund also highlights a structural shift in venture capital. The industry is bifurcating into a small number of mega-firms that can write cheques of $100 million or more and a long tail of smaller funds that compete for earlier-stage deals. The middle ground, the traditional Series B and C investors, is being squeezed by mega-funds moving downstream and by AI companies that skip traditional funding stages entirely, going from seed round to billion-dollar valuations in 18 months.

For a firm like Accel, which operates across offices in Palo Alto, San Francisco, London, and India, the $5 billion raise is a bet that it can maintain its position in the top tier as fund sizes inflate and competition for the best deals intensifies. Its portfolio of 1,199 companies, 107 unicorns, and 46 IPOs provides a track record. But in a market where Anthropic alone could generate returns that justify an entire fund, the temptation to concentrate bets on a handful of AI winners is strong, and the consequences of getting those bets wrong are correspondingly severe.

The broader picture is that AI venture capital has entered a phase where the funds themselves are becoming as large as the companies they once backed. Accel’s $5 billion raise would have made it one of the most valuable startups in Europe just a few years ago. Now it is table stakes for a firm that wants to participate meaningfully in the rounds that matter. Whether this represents rational capital allocation or the peak of a cycle that will eventually correct is the question that every LP writing a cheque today is, implicitly or explicitly, answering in the affirmative.



Source link