{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Microsoft Exchange Server 2019 Cumulative Update 15","product":{"name":"N/A","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Exchange Server 2016 Cumulative Update 23","product":{"name":"N/A","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Exchange Server Subscription Edition RTM","product":{"name":"N/A","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Exchange Server 2019 Cumulative Update 14","product":{"name":"N/A","vendor":{"name":"Microsoft","scada":false}}}],"affected_systems_content":"","content":"## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des correctifs (cf. section Documentation).","cves":[{"name":"CVE-2026-42897","url":"https://www.cve.org/CVERecord?id=CVE-2026-42897"}],"links":[],"reference":"CERTFR-2026-AVI-0599","revisions":[{"description":"Version initiale","revision_date":"2026-05-15T00:00:00.000000"}],"risks":[{"description":"Injection de code indirecte \u00e0 distance (XSS)"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"}],"summary":"Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Microsoft Exchange Server. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.\n\nMicrosoft indique que la vuln\u00e9rabilit\u00e9 CVE-2026-42897 est activement exploit\u00e9e.","title":"Vuln\u00e9rabilit\u00e9 dans Microsoft Exchange Server","vendor_advisories":[{"published_at":"2026-05-14","title":"Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42897","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"}]}