Addressing Exchange Server May 2026 vulnerability CVE-2026-42897

In our case, the changes made (by the Exchange Emergency Mitigation Service) to the web.conf of the owa site resulted in duplicate entries. You can check this by opening the IIS Manager, go to the owa tree and open the URL Rewrite module. This shows an error and the GUI is not able to handle the URL Rewrite configuration any more. I guess the IIS is not happy with this, too ;) 

The error massage stated that there is some duplicate for type "Precondition".  Opening the config file itself (usually at C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\web.config) shows two entries for system.webServer . The second one at the end of the file looks like this:

    <system.webServer>
        <rewrite>
            <outboundRules>
                <rule name="EEMS M2.1 OWA CSP - outbound" preCondition="EEMS M2.1 OWA SPA HTML shell - precondition" patternSyntax="ECMAScript" stopProcessing="false">
                    <match serverVariable="RESPONSE_Content_Security_Policy" pattern="(.*)" />
                    <action type="Rewrite" value="{R:1}; script-src-attr 'none'" />
                </rule>
                <preConditions>
                    <preCondition name="EEMS M2.1 OWA SPA HTML shell - precondition" logicalGrouping="MatchAll" patternSyntax="ECMAScript">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                        <add input="{REQUEST_URI}" pattern="^/owa/?($|\?|default\.aspx|projection\.aspx|readingPane\.aspx|popout\.aspx)" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
    </system.webServer>

I'm not that familiar with those ASP.NET config things but I guess, the content of the second entry should be placed at the end of the first entry. Copying the content inside the "rewrite"-Tags (including the rewrite open and closing tags) just before the first occurrence of the closing system.webServer tag and deleting the above content should do the job.

For me, this works (sharing .html/.ics works again) - and the URL-Rewrite configuration is accessible from IIS-Manager again and it looks reasonable. Can anyone confirm this, please?