Addressing Exchange Server May 2026 vulnerability CVE-2026-42897

Dear MS Team,

in our case (Exchange SE), the auto applied mitigation changed the web.config for the owa virtual directory in a way that it leaves the URL-Rewrite Module inaccessible from the IIS Manager (for the owa tree). Trying to verify the settings (IIS-Manager -> Server -> Sites -> Default Website -> owa -> URL Rewrite) results in this Error-Message:  

Hitting OK shows a blank configuration of URL Rewrite module.

Further inspections shows, that calendar sharing via .html and .ics in OWA does not work any more and results in Error 500 when clicking the links to the html/ics documents in OWA.

Checking the file in the error message (web.config) the structure of this XML-File looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <configSections>
    ...
  </configSections>
  <location inheritInChildApplications="false">
    <system.webServer>
        ...
    </system.webServer>
    <system.web>
        ...
    </system.web>
  </location>
  <appSettings>
    ...
  </appSettings>
  <system.serviceModel>
    ...
  </system.serviceModel>
  <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
    ...
  </assemblyBinding>

    <system.webServer>
        <rewrite>
            <outboundRules>
                <rule name="EEMS M2.1 OWA CSP - outbound" preCondition="EEMS M2.1 OWA SPA HTML shell - precondition" patternSyntax="ECMAScript" stopProcessing="false">
                    <match serverVariable="RESPONSE_Content_Security_Policy" pattern="(.*)" />
                    <action type="Rewrite" value="{R:1}; script-src-attr 'none'" />
                </rule>
                <preConditions>
                    <preCondition name="EEMS M2.1 OWA SPA HTML shell - precondition" logicalGrouping="MatchAll" patternSyntax="ECMAScript">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                        <add input="{REQUEST_URI}" pattern="^/owa/?($|\?|default\.aspx|projection\.aspx|readingPane\.aspx|popout\.aspx)" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
    </system.webServer>

</configuration><?xml version="1.0" encoding="utf-8"?>

Question to the MS Team: is this correct and is the mitigation still working (even though IIS-Manager complains)? Or is action required here?

For me this looks like the rewrite rule was inserted in the wrong place. It looks like these lines between the open and closing tags of "system.webServer" on the bottom of the file should go below configuration/location/system.webServer (and the indentation of the added lines reinforces the assumption):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <configSections>
    ...
  </configSections>
  <location inheritInChildApplications="false">
    <system.webServer>
        ...
        <!--  HERE ???   -->
    </system.webServer>
    <system.web>
        ...        
    </system.web>
  </location>
...

Placing the rewrite-rule here makes the Rewrite-Rule appear in IIS-Manager and calendar sharing (htlm/ics) works again...

Please MS Team comment on this... thanks!