u/HJForsythe

Howdy, I'm just checking in to see if anyone else is seeing the same behavior that I am seeing for CVE-2026-42897

[PS] D:\Exchange\scripts>./Get-Mitigations.ps1

Server : labexchange

Version : Version 15.2 (Build 1544.4)

ID : PING1

Type : Ping

Description : EEMS Heartbeat probe. Does not modify any exchange settings.

Status : Applied

Server : labexchange

Version : Version 15.2 (Build 1544.4)

ID : M2.1.0

Type :

Description : Mitigation invalid for this exchange version.

Status : Applied

So it appears it isn't mitigated here so I tried using EOMT to mitigate it:

.\EOMT.ps1 -CVE "CVE-2026-42897"

Starting EOMT.ps1 version 26.05.14.1633 on labexchange

Resolved mitigation target: CVE-2026-42897 - OWA XSS - Outbound URL Rewrite adding Content-Security-Policy script-src-attr 'none' to OWA HTML responses

Applying CVE-2026-42897 mitigation

This tool applies an IIS URL Rewrite mitigation for CVE-2026-42897.

Mitigations are a temporary measure. Installation of the applicable Security Update

is the ***only way to fully protect your servers***.

Get the latest Exchange Server update here: https://aka.ms/LatestExchangeServerUpdate

Do you want to proceed?

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y

[1/1] Checking prerequisites on labexchange

labexchange : Mitigation already applied for CVE-2026-42897 — skipping

Servers not vulnerable (skipped): labexchange

No vulnerable servers to apply mitigation to.

Is anyone seeing something similar or have any explanation for why healthchecker would say it isn't mitigated but EOMT would say it is mitigated?

Howdy,

After the February or March Windows Update cycle on Windows 2016 I noticed that services have been failing to automatically start after reboot. Has anyone else been experiencing this or am I just lucky? I haven't really had time to dig into it and mostly just have to login to the server (after Windows updates) and restart everything manually. I'm going to start digging into it now but I just wanted to ask if this is something anybody else has seen? Everything had been working flawlessly up until a month or two ago.

I also noticed that the Windows Search Service is crashing constantly beginning on March 12th after the March 10 updates.

Hi,

A friend of mine's account was compromised which should've been impossible because they had 2fa OTP codes. So I logged into mine and I noticed that once you add a passkey to your account Coinbase completely disregards your preference for two factor authentication from that point onward.

This is a warning to both users of Coinbase and the company. For users they should be aware that your highly sophisticated security device is no longer being used by Coinbase without any disclosure. For Coinbase its a warning that you are opening yourselves up to lawsuits by making changes to user authentication without informing your customers.

Have a nice day and be safe everyone.