Loading story…
Researchers identified OWASSRF, an in-the-wild exploit chain targeting on-premises Microsoft Exchange Server through Outlook Web Access (OWA). The technique combines CVE-2022-41080 and CVE-2022-41082 to obtain remote code execution and bypasses URL-rewrite mitigations deployed against the earlier ProxyNotShell exploitation path involving CVE-2022-41040 and CVE-2022-41082.
The Play ransomware group was observed using OWASSRF against organizations, with victims concentrated in Latin America and particularly Brazil. Exchange Server 2013, 2016, and 2019 installations that remain unpatched are affected; Microsoft’s KB5019758 security update, or a later update, remediates the exposure. Organizations unable to patch immediately should disable OWA and limit Remote PowerShell and externally accessible Exchange services.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers detected in-the-wild OWASSRF exploitation, in which the Play ransomware group chained CVE-2022-41080 and CVE-2022-41082 through Outlook Web Access to bypass ProxyNotShell URL-rewrite mitigations and execute code. The activity primarily targeted Latin American organizations, particularly in Brazil.
Microsoft released November 2022 Patch Tuesday updates, including KB5019758 for Exchange Server 2013, 2016, and 2019. The update addressed CVE-2022-41040, CVE-2022-41080, and CVE-2022-41082.
Exploitation of the ProxyNotShell Exchange vulnerability chain, involving CVE-2022-41040 and CVE-2022-41082, was reported in the wild. CVE-2022-41040 is an SSRF vulnerability and CVE-2022-41082 permits remote code execution on affected Exchange servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-42897**, a cross-site scripting flaw in on-premises **Exchange Server** Outlook Web Access (**OWA**), affecting Exchange Server 2016, 2019, and Subscription Edition. The bug can be triggered by a specially crafted email and may execute arbitrary JavaScript when a user opens the message in OWA under certain interaction conditions. Microsoft said **Exchange Online is not affected** and pushed an automatic mitigation through the **Exchange Emergency Mitigation Service** as mitigation ID `M2.1.x`, while also providing a scripted workaround for disconnected environments through the Exchange on-premises Mitigation Tool. Proofpoint reported that Russia-aligned **TA488** exploited the flaw in a 22 July campaign targeting U.S. and European government organizations as well as telecommunications, financial, hospitality, and aerospace entities. The operation used "half-click" emails to deliver **OWAReaper**, a previously unknown JavaScript implant that runs entirely inside the OWA browser context, steals credentials and tokens, and maintains persistence across browser restarts, credential changes, and even device reimaging; it also used GitHub commit messages and attacker-controlled emails for command-and-control, with data exfiltration over HTTPS and fallback DNS tunneling. Proofpoint assessed that infrastructure timing suggests the actor may have used `CVE-2026-42897` as a zero-day before Microsoft's out-of-band fix.
Aug 11, 2026
Microsoft released fixes for **CVE-2026-42897**, a high-severity spoofing flaw in **Exchange Server** that was actively exploited in attacks and could lead to arbitrary JavaScript execution through cross-site scripting in **Outlook Web Access (OWA)**. The vulnerability affects **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**, and can be triggered remotely without privileges by sending a specially crafted email that executes when opened in OWA under certain user-interaction conditions. Microsoft classifies the issue as a spoofing vulnerability, consistent with prior MSHTML- and web-rendering-related spoofing flaws such as **CVE-2024-43461**. Before full patches were released, Microsoft deployed an automatic temporary mitigation through the **Exchange Emergency Mitigation Service** in mid-May and later shipped permanent fixes in its June 2026 security updates, while advising administrators to keep mitigations enabled and patch immediately. **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog on May 15 and ordered U.S. federal agencies to remediate affected systems by May 29, underscoring continued attacker focus on Exchange, which has seen numerous exploited flaws over the past five years, including several linked to ransomware activity.
Jun 29, 2026
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026