CVE-2026-42897 is a cross-site scripting vulnerability in the Outlook Web Access component of on-premises Exchange Server 2016, 2019, and Subscription Edition. When a victim opens a crafted email in OWA, the XSS payload executes arbitrary JavaScript in their browser session with their Exchange permissions. For users with administrative access to Exchange, that means arbitrary actions within the Exchange management interface. Microsoft first disclosed it on May 13 with active exploitation already confirmed.
The Exchange Emergency Mitigation Service applied a server-side control that reduced the attack surface but did not patch the underlying vulnerability. That temporary mitigation has been the only available protection for four weeks. The federal remediation deadline passed May 29 with no permanent fix available. Today’s June Patch Tuesday release delivers the permanent fix.
Administrators should apply the June update to all on-premises Exchange deployments and verify patch installation through the Exchange Management Shell. After confirming the permanent patch is in place, the EM mitigation can be removed.
- Apply the June 9 Patch Tuesday update to all on-premises Exchange Server 2016, 2019, and Subscription Edition deployments.
- Verify the patch is applied via the Exchange Management Shell before retiring the Exchange Emergency Mitigation control.
- Review Exchange OWA access logs for anomalous JavaScript execution events or unexpected administrative actions during the May 13 to June 9 window if a full review has not yet been completed.
CVE-2026-45659 is a remote code execution vulnerability in Microsoft SharePoint Server addressed in the June 9 Patch Tuesday release. The vulnerability carries a CVSS score of 8.8 and Microsoft has assigned it important severity. An authenticated attacker with no elevated privileges can exploit the flaw to execute code remotely on affected SharePoint Server versions.
Microsoft has not confirmed exploitation in the wild at time of writing. However, SharePoint RCE vulnerabilities have historically moved from patch release to active exploitation within days when the barrier to exploitation is low authentication requirements rather than administrative access. CVE-2026-45659 fits that profile: authenticated but no elevated privileges means anyone with a SharePoint account is a potential starting point for exploitation.
- Apply the June 9 Patch Tuesday update to all SharePoint Server deployments. Prioritise internet-facing instances but patch internal deployments on the same cycle.
- Monitor Microsoft MSRC and threat intelligence feeds for exploitation confirmation over the next 72 hours.
DAEMON Tools CVE-2026-8398: Update to version 12.6 or later, or uninstall. On any machine that ran an affected version between April and May 2026, rotate credentials regardless of whether the software has since been updated. The credential rotation is the remediation; the software update closes the future exposure.
TanStack CVE-2026-45321: Run a software composition analysis covering package.json, lock files, cached CI packages, and container images built during the compromise window. Confirm no references to the compromised package versions remain in any active build pipeline or deployed artifact.
Nx Console CVE-2026-48027: Confirm the Nx Console VS Code extension is on the patched version. On any developer machine that had the compromised extension installed during the May window, rotate GitHub tokens, cloud provider keys, CI/CD secrets, and npm tokens. The extension update closes future exposure; only the credential rotation addresses the past.
- Complete all three KEV remediations today. The deadline is today.
- For TanStack, verify the SCA covers lock files and container image layers specifically, not only the current package.json entries.
- For Nx Console, confirm developer credential rotation has been completed on all affected machines, not just the extension update.