Loading story…
Microsoft disclosed CVE-2026-42897, a cross-site scripting flaw in on-premises Exchange Server Outlook Web Access (OWA), affecting Exchange Server 2016, 2019, and Subscription Edition. The bug can be triggered by a specially crafted email and may execute arbitrary JavaScript when a user opens the message in OWA under certain interaction conditions. Microsoft said Exchange Online is not affected and pushed an automatic mitigation through the Exchange Emergency Mitigation Service as mitigation ID M2.1.x, while also providing a scripted workaround for disconnected environments through the Exchange on-premises Mitigation Tool.
Proofpoint reported that Russia-aligned TA488 exploited the flaw in a 22 July campaign targeting U.S. and European government organizations as well as telecommunications, financial, hospitality, and aerospace entities. The operation used "half-click" emails to deliver OWAReaper, a previously unknown JavaScript implant that runs entirely inside the OWA browser context, steals credentials and tokens, and maintains persistence across browser restarts, credential changes, and even device reimaging; it also used GitHub commit messages and attacker-controlled emails for command-and-control, with data exfiltration over HTTPS and fallback DNS tunneling. Proofpoint assessed that infrastructure timing suggests the actor may have used CVE-2026-42897 as a zero-day before Microsoft's out-of-band fix.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Proofpoint reported that the TA488 campaign delivered a previously unknown browser-resident JavaScript implant named OWAReaper. The malware operates inside the OWA browser context, steals credentials and tokens, establishes persistence in OWA and Exchange, and supports command-and-control via GitHub commit messages and attacker emails.
On July 22, 2026, Proofpoint said Russia-aligned threat actor TA488 began a campaign exploiting CVE-2026-42897 via 'half-click' emails that execute when opened in OWA. The activity targeted U.S. and European government entities as well as telecommunications, financial, hospitality, and aerospace organizations.
According to the new reference, Microsoft released a full fix for CVE-2026-42897 in June 2026 after initially warning of exploitation and providing temporary mitigations in May. This represents the patch release stage of the vulnerability response.
Microsoft published an automatic mitigation for CVE-2026-42897 through the Exchange Emergency Mitigation Service as mitigation ID M2.1.x and advised customers to enable the service if disabled. For disconnected or air-gapped environments, Microsoft also provided a scripted mitigation path using the Exchange on-premises Mitigation Tool.
On May 14, 2026, Microsoft disclosed CVE-2026-42897, a vulnerability affecting Outlook Web Access on on-premises Exchange Server 2016, 2019, and Subscription Edition. The flaw could be triggered by a specially crafted email and lead to arbitrary JavaScript execution in the browser context when opened in OWA under certain interaction conditions.
Proofpoint said the Russia-aligned actor tracked as TA488, also known as Laundry Bear/Void Blizzard, had prepared infrastructure for its Exchange OWA exploitation campaign in March 2026. The same reporting said the group exploited CVE-2026-42897 as a zero-day before Microsoft's May 14 advisory.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
12 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcehelpnetsecurity.com
Open sourcecommunity.gurucul.com
Open sourcetheregister.com
Open sourcetherecord.media
Open sourceproofpoint.com
Open sourcecert.pa
Open sourcetechcommunity.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-linked **TA488**—also tracked as Void Blizzard or Laundry Bear—has reportedly exploited **CVE-2026-42897**, a high-severity stored cross-site scripting flaw (`CVSS 8.1`) in on-premises Microsoft Exchange Server Outlook Web Access. A crafted HTML email triggers attacker-controlled JavaScript when opened in an authenticated OWA session, without requiring an additional click, deploying the fileless browser-resident **OWAReaper** implant. Exchange Online and Microsoft 365 are reportedly not affected. OWAReaper can enumerate and collect mailbox data, steal browser autofill credentials and Exchange Web Services OAuth tokens, execute encrypted modules, and establish persistence by granting the built-in `Default` mailbox user Owner permissions. It stores components in browser LocalStorage, IndexedDB, and Outlook cache, uses GitHub Commit Search for command retrieval, and exfiltrates through HTTPS traffic relayed via image CDNs and DNS tunneling. Organizations using affected on-premises Exchange versions should apply the available updates, revoke potentially exposed tokens, audit mailbox permissions, and clear browser storage to remove residual implant persistence.
Sep 4, 2026
Microsoft released fixes for **CVE-2026-42897**, a high-severity spoofing flaw in **Exchange Server** that was actively exploited in attacks and could lead to arbitrary JavaScript execution through cross-site scripting in **Outlook Web Access (OWA)**. The vulnerability affects **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**, and can be triggered remotely without privileges by sending a specially crafted email that executes when opened in OWA under certain user-interaction conditions. Microsoft classifies the issue as a spoofing vulnerability, consistent with prior MSHTML- and web-rendering-related spoofing flaws such as **CVE-2024-43461**. Before full patches were released, Microsoft deployed an automatic temporary mitigation through the **Exchange Emergency Mitigation Service** in mid-May and later shipped permanent fixes in its June 2026 security updates, while advising administrators to keep mitigations enabled and patch immediately. **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog on May 15 and ordered U.S. federal agencies to remediate affected systems by May 29, underscoring continued attacker focus on Exchange, which has seen numerous exploited flaws over the past five years, including several linked to ransomware activity.
Jun 29, 2026
Researchers identified **OWASSRF**, an in-the-wild exploit chain targeting on-premises Microsoft Exchange Server through Outlook Web Access (OWA). The technique combines `CVE-2022-41080` and `CVE-2022-41082` to obtain remote code execution and bypasses URL-rewrite mitigations deployed against the earlier ProxyNotShell exploitation path involving `CVE-2022-41040` and `CVE-2022-41082`. The Play ransomware group was observed using OWASSRF against organizations, with victims concentrated in Latin America and particularly Brazil. Exchange Server 2013, 2016, and 2019 installations that remain unpatched are affected; Microsoft’s `KB5019758` security update, or a later update, remediates the exposure. Organizations unable to patch immediately should disable OWA and limit Remote PowerShell and externally accessible Exchange services.
Sep 3, 2026