Microsoft patches Exchange Server zero-day exploited in attacks

Microsoft patched the high-severity Exchange Server vulnerability CVE-2026-42897, which was actively exploited to execute arbitrary JavaScript in cross-site scripting attacks targeting Outlook Web Access users.