Microsoft has released Security Updates (SUs) for vulnerabilities found in:
Exchange Server Subscription Edition (SE)
Exchange Server 2019
Exchange Server 2016
SUs are available for the f...
Updated Jul 24, 2026
Version 2.0
Blog Post
trying to remove mitigations manually from Exchange server with July 2026 SU applied using latest EOMT. Two questions
- EOMT still shows 'Code fix applied: False', does this mean you have not updated EOMT yet and i should wait until you do?
- the output shoes 3 mitigations, do i remove only CVE-2026-42897 or all 3 of them, are the other 2 part of July SU update?
.\EOMT.ps1 -ShowMitigationStatus
Available CVE mitigations:
[1] CVE-2026-42897 (default)
[2] CVE-2022-41040
[3] CVE-2021-26855
Select CVE by number or ID [CVE-2026-42897]: 1
Starting EOMT.ps1 version 26.05.15.2009 on EXServer01
Resolved mitigation target: CVE-2026-42897 - OWA XSS - Outbound URL Rewrite adding Content-Security-Policy script-src-attr 'none' to OWA HTML responses
Checking mitigation status for CVE-2026-42897 on EXServer01
EXServer01 : Code Fix Applied: False | Mitigation Applied: True
thank you
- Nino_Bilic
Microsoft
Indeed EOMT need to be updated to reflect that July 2026 update is "Code fix applied: true" for CVE-2026-42897. The other two mitigations are from 4-5 years ago - which mitigations did you apply? See EOMT - Microsoft - CSS-Exchange for documentation of all mitigations that EOMT knows about.
You do not need to wait for EOMT to be updated to show that July update is "code fix applied" - you can use it to remove CVE-2026-42897 mitigation and we'll sort out the EOMT and it's awareness of July 2026 update separately.
EDIT: I now opened the issue for this EOMT update here: [Issue]Update EOMT to mark July 2026 SU as Code fix applied: True for CVE-2026-42897 · Issue #2568 · microsoft/CSS-Exchange
Script has been updated and now shows July SU as being "Code fix applied: true".
Awesome, thank you for the update. I can confirm that it now shows True.
