Russian actor exploits Outlook Web Access flaw for mailbox access that survives resets

Proofpoint reported a Russia-aligned group, tracked as Laundry Bear or TA488, exploiting a cross-site scripting flaw in on-premises Outlook Web Access to plant a stealthy backdoor. Tracked as CVE-2026-42897 and rated 8.1, it is a half-click exploit: opening a crafted email in OWA runs attacker JavaScript in the session. The implant, OWAReaper, steals OAuth tokens from mailbox add-ins and grants the low-privilege Default user Owner rights on every mail folder, so any account in the organization can read the mailbox. Because that grant lives on the Exchange server, rotating credentials and re-imaging the device do not remove the access. Microsoft flagged exploitation since May.

Check

Confirm on-premises Exchange has the fix for this flaw, then audit mailbox folder permissions for Owner rights wrongly granted to the Default user, and review add-ins with mailbox write access.

Affected

Organizations running on-premises Exchange Outlook Web Access (CVE-2026-42897); opening a crafted email runs attacker code, and the backdoor's server-side permission grant keeps access alive through credential resets and re-imaging.

Fix

Patch, then remove the malicious folder-permission grants and audit add-ins with mailbox write access, since patching alone does not evict the attacker, and hunt for OWAReaper artifacts and unusual token use.