Microsoft Outlook blocks inline SVG rendering to reduce XSS and phishing abuse
Security Tool/Service
Summary
Hide ▲
Show ▼
Microsoft is blocking inline SVG images in Outlook for Web and the new Outlook for Windows, reducing exposure to SVG-based phishing and cross-site scripting (XSS) abuse. The rollout began in early September 2025 and is expected to finish by mid-October 2025. Users will see blank spaces where inline SVG content would have appeared, while classic SVG attachments remain viewable. Microsoft says the change should affect less than 0.1% of images sent through Outlook.
Related Happenings
Microsoft Exchange CVE-2026-42897 mitigation advisory
Advisory/Mitigation
H score44
First: 15.05.2026 12:40
Last: 15.05.2026 12:40
Sources 1
About this happening:
Microsoft issued immediate mitigation guidance for CVE-2026-42897, reducing risk for Exchange Server 2016, 2019, and Subscription Edition (SE) on-premises servers that...
Microsoft Exchange CVE-2026-42897 mitigation advisory
Advisory/MitigationAbout this happening: Microsoft issued immediate mitigation guidance for CVE-2026-42897, reducing risk for Exchange Server 2016, 2019, and Subscription Edition (SE) on-premises servers that...
Latest development: 15.05.2026 15:35
Microsoft issued temporary mitigation guidance for CVE-2026-42897 while a patch is still in development, recommending the Exchange Emergency Mitigation (EM) Service, which is enabled by default and can be checked with the Exchange Health Checker script, or the Exchange On-premises Mitigation Tool (EOMT) for disconnected or air-gapped environments. Microsoft noted that the mitigations can disrupt features such as OWA Print Calendar and Inline images, and that servers older than March 2023 cannot receive new mitigations through EM Service.
Microsoft Exchange Server spoofing/XSS flaw under active exploitation (CVE-2026-42897)
Vulnerability
H score37
First: 15.05.2026 09:19
Last: 15.05.2026 09:19
Sources 1
About this happening:
CVE-2026-42897 is an actively exploited spoofing vulnerability in on-premises Microsoft Exchange Server that can lead to arbitrary JavaScript execution in a br...
Microsoft Exchange Server spoofing/XSS flaw under active exploitation (CVE-2026-42897)
VulnerabilityAbout this happening: CVE-2026-42897 is an actively exploited spoofing vulnerability in on-premises Microsoft Exchange Server that can lead to arbitrary JavaScript execution in a br...
Latest development: 09.06.2026 20:57
Microsoft identifies CVE-2026-42897 in Microsoft Exchange Server as an actively exploited spoofing vulnerability that can lead to JavaScript execution in a target’s browser when a specially crafted email is opened in Outlook Web Access under certain interaction conditions. Microsoft says mitigations are being pushed through the Exchange Emergency Mitigation Service while it continues work on the full update.
Microsoft May 2026 Patch Tuesday (120 flaws)
Security Patch Release
H score31
First: 12.05.2026 21:08
Last: 12.05.2026 21:08
Sources 1
About this happening:
Microsoft released its May 2026 Patch Tuesday updates, fixing 120 flaws and disclosing no zero-days. The bundle includes 17 Critical vulnerabilities, with mult...
Microsoft May 2026 Patch Tuesday (120 flaws)
Security Patch ReleaseAbout this happening: Microsoft released its May 2026 Patch Tuesday updates, fixing 120 flaws and disclosing no zero-days. The bundle includes 17 Critical vulnerabilities, with mult...
Code of conduct-themed Microsoft AiTM phishing campaign
Campaign
H score53
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
A large-scale phishing campaign used code of conduct-themed lures and legitimate email services to push victims to attacker-controlled domains and steal authentication t...
Code of conduct-themed Microsoft AiTM phishing campaign
CampaignAbout this happening: A large-scale phishing campaign used code of conduct-themed lures and legitimate email services to push victims to attacker-controlled domains and steal authentication t...
Microsoft Outlook.com outage causing sign-in failures
Service Disruption
H score20
First: 27.04.2026 15:03
Last: 27.04.2026 15:03
Sources 1
About this happening:
Microsoft's Outlook.com is experiencing an ongoing outage that is blocking sign-ins and mailbox access, leaving some customers unable to use email normally. The disruption...
Microsoft Outlook.com outage causing sign-in failures
Service DisruptionAbout this happening: Microsoft's Outlook.com is experiencing an ongoing outage that is blocking sign-ins and mailbox access, leaving some customers unable to use email normally. The disruption...
Timeline
-
02.10.2025 21:13 2 articles · 9mo ago
Microsoft blocks inline SVG rendering in Outlook
Mitigation Patch UpdateMicrosoft is rolling out a change in Outlook for Web and the new Outlook for Windows that stops displaying risky inline SVG images used in attacks, replacing them with blank spaces while keeping SVG images sent as classic attachments viewable from the attachment well. Microsoft says the change helps mitigate potential security risks such as cross-site scripting (XSS), began rolling out worldwide in early September 2025, is expected to be completed for all customers by mid-October 2025, and should affect less than 0.1% of all images sent using Outlook.
Show sources
- Microsoft Outlook stops displaying inline SVG images used in attacks — www.bleepingcomputer.com — 02.10.2025 21:13
- Microsoft Outlook stops displaying inline SVG images used in attacks — www.bleepingcomputer.com — 02.10.2025 21:13