Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: exchange (3 articles)Clear
vulnerability
CVE-2026-42897
2026-07-30

Russian actor exploits Outlook Web Access flaw for mailbox access that survives resets

Proofpoint reported a Russia-aligned group, tracked as Laundry Bear or TA488, exploiting a cross-site scripting flaw in on-premises Outlook Web Access to plant a stealthy backdoor. Tracked as CVE-2026-42897 and rated 8.1, it is a half-click exploit: opening a crafted email in OWA runs attacker JavaScript in the session. The implant, OWAReaper, steals OAuth tokens from mailbox add-ins and grants the low-privilege Default user Owner rights on every mail folder, so any account in the organization can read the mailbox. Because that grant lives on the Exchange server, rotating credentials and re-imaging the device do not remove the access. Microsoft flagged exploitation since May.

exchangeowaxsslaundry-bearpersistence
Check
Confirm on-premises Exchange has the fix for this flaw, then audit mailbox folder permissions for Owner rights wrongly granted to the Default user, and review add-ins with mailbox write access.
Affected
Organizations running on-premises Exchange Outlook Web Access (CVE-2026-42897); opening a crafted email runs attacker code, and the backdoor's server-side permission grant keeps access alive through credential resets and re-imaging.
Fix
Patch, then remove the malicious folder-permission grants and audit add-ins with mailbox write access, since patching alone does not evict the attacker, and hunt for OWAReaper artifacts and unusual token use.
vulnerability
CVE-2026-42897
2026-06-11

Microsoft finally patches actively exploited Exchange OWA spoofing zero-day

Microsoft has shipped the first full patch for an Exchange Server zero-day that attackers have been exploiting since May. The flaw (CVE-2026-42897) is a cross-site scripting bug in Outlook Web Access: an attacker emails a victim, and when the message is opened in OWA, malicious JavaScript runs inside the victim's authenticated session, allowing session-token theft and mailbox impersonation without ever touching the server. It affects Exchange Server 2016, 2019, and Subscription Edition, and CISA added it to its known-exploited list back in May. Until this week only temporary mitigations existed; the June security updates provide the permanent fix.

microsoftexchangeowaxssactively-exploited
Check
Confirm the June 2026 security update is applied to all on-premises Exchange servers, and review OWA and mailbox audit logs for suspicious script activity or session hijacking since May.
Affected
On-premises Microsoft Exchange Server 2016, 2019, and Subscription Edition exposing Outlook Web Access (CVE-2026-42897), a spoofing and cross-site scripting flaw exploited in attacks since May.
Fix
Apply the June 2026 Exchange security update now to replace the earlier mitigation-only guidance, then reset potentially exposed OWA sessions and rotate credentials for affected mailboxes.
threat
2026-05-01

China-linked spy group has been quietly breaking into government Exchange servers across Asia and one NATO country since 2024

Trend Micro disclosed a China-aligned espionage cluster called SHADOW-EARTH-053 that has been targeting government and defense organizations across South, East, and Southeast Asia plus one NATO European country since at least December 2024. The group breaks in by exploiting unpatched Microsoft Exchange and IIS servers (using known flaws like ProxyLogon), drops a Godzilla web shell for persistent access, then uses DLL sideloading to load ShadowPad - a long-running Chinese implant. The targeting overlaps with Earth Alux and REF7707, suggesting either a shared operator or shared infrastructure across China-aligned groups. Targets include journalists and activists alongside government agencies.

shadow-earth-053china-apttrend-microexchangeiisproxylogongodzillashadowpaddll-sideloadingnatotransnational-repressionjournalists
Check
If you run Microsoft Exchange or IIS, confirm every server is patched against ProxyLogon and recent Exchange CVEs - the entry point is unpatched 2-3 year old flaws, not zero-days.
Affected
Government and defense organizations in South, East, and Southeast Asia and the NATO European country are the named targets. Any organization running internet-facing Microsoft Exchange or IIS that has fallen behind on patching is at risk. Diaspora communities and journalists working on China-related stories are at acute risk - the campaign extends transnational repression alongside conventional espionage.
Fix
Patch Microsoft Exchange and IIS to current versions and confirm with active scanning. Hunt for Godzilla web shell artifacts: unusual .aspx files in Exchange's web directories, suspicious POSTs with encrypted payloads, and outbound HTTPS to unfamiliar domains from Exchange/IIS processes. For journalists and activists working on China topics, follow Citizen Lab guidance: hardware MFA, encrypted communications, skepticism of unsolicited story tips.