Proofpoint reported a Russia-aligned group, tracked as Laundry Bear or TA488, exploiting a cross-site scripting flaw in on-premises Outlook Web Access to plant a stealthy backdoor. Tracked as CVE-2026-42897 and rated 8.1, it is a half-click exploit: opening a crafted email in OWA runs attacker JavaScript in the session. The implant, OWAReaper, steals OAuth tokens from mailbox add-ins and grants the low-privilege Default user Owner rights on every mail folder, so any account in the organization can read the mailbox. Because that grant lives on the Exchange server, rotating credentials and re-imaging the device do not remove the access. Microsoft flagged exploitation since May.
Microsoft has shipped the first full patch for an Exchange Server zero-day that attackers have been exploiting since May. The flaw (CVE-2026-42897) is a cross-site scripting bug in Outlook Web Access: an attacker emails a victim, and when the message is opened in OWA, malicious JavaScript runs inside the victim's authenticated session, allowing session-token theft and mailbox impersonation without ever touching the server. It affects Exchange Server 2016, 2019, and Subscription Edition, and CISA added it to its known-exploited list back in May. Until this week only temporary mitigations existed; the June security updates provide the permanent fix.
Just two days after a 138-fix Patch Tuesday that listed no zero-days, Microsoft disclosed CVE-2026-42897, an Exchange Server XSS-to-spoofing flaw it has tagged 'Exploitation Detected.' The bug is rated CVSS 8.1 and reported by an anonymous researcher. An unauthenticated attacker emails a crafted message; if the victim opens it in Outlook Web Access and meets certain interaction conditions, arbitrary JavaScript runs in the browser session context, enabling spoofing and session abuse. On-prem Exchange Server 2016, 2019, and Subscription Edition are affected; Exchange Online is not. No permanent patch exists yet, only mitigation through the Exchange Emergency Mitigation Service.
TrustStrike Labs