{"id":"exchange-owa-xss-attacks-may-2026","category":"patch","status":"closed","title":"Microsoft Exchange Outlook Web Access flaw CVE-2026-42897 exploited for persistent mailbox access","tldr":"Attackers used malicious emails to compromise people reading mail through vulnerable Exchange Outlook Web Access servers. Fixes are available. Ask your email administrator to install current Exchange updates and check for persistent mailbox access.","summary":"CVE-2026-42897 affects Outlook Web Access on organisations' own Microsoft Exchange servers, including Exchange 2016, 2019 and Subscription Edition. Opening a specially crafted email, under Microsoft's stated interaction conditions, can let an attacker run JavaScript inside the user's signed-in browser session. Exchange Online is unaffected. Microsoft disclosed active exploitation on 14 May, initially offering emergency mitigations. June security updates fixed the vulnerability; July updates removed Microsoft's recommendation to retain the mitigation. In July, Proofpoint observed Russia-aligned TA488 using the flaw to deliver OWAReaper against government bodies and several business sectors. The malware could steal credentials and tokens and change mailbox permissions to preserve access despite password changes or device rebuilding. Compromised organisations therefore need investigation and clean-up alongside patching. Microsoft rates the flaw high, with CVSS 8.1; NVD's separate assessment is 6.1. The reviewed reporting does not establish that the attacks have ended.","action":"If your work or family office runs its own Exchange email server, ask its IT provider to install the latest applicable Exchange security updates, including the July 2026 update or later, and investigate possible OWAReaper access. Suspected compromises need mailbox permissions, tokens and browser storage checked; changing a password alone is insufficient. Exchange Online users have no update to install for this flaw.","product":"Microsoft Exchange Server 2016, 2019 and Subscription Edition — Outlook Web Access","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-42897"],"tags":["microsoft","exchange","webmail","xss","zero-day","espionage"],"affected":["Microsoft Exchange Server 2016 Cumulative Update 23: versions from 15.01.0.0 below 15.01.2507.069","Microsoft Exchange Server 2019 Cumulative Update 14: versions from 15.02.0.0 below 15.02.1544.041","Microsoft Exchange Server 2019 Cumulative Update 15: versions from 15.02.0.0 below 15.02.1748.046","Microsoft Exchange Server Subscription Edition RTM: versions from 15.02.0.0 below 15.02.2562.043"],"fixed":["Microsoft Exchange Server 2016 Cumulative Update 23: 15.01.2507.069","Microsoft Exchange Server 2019 Cumulative Update 14: 15.02.1544.041","Microsoft Exchange Server 2019 Cumulative Update 15: 15.02.1748.046","Microsoft Exchange Server Subscription Edition RTM: 15.02.2562.043"],"matches":[],"sources":[{"kind":"advisory","title":"Addressing Exchange Server May 2026 vulnerability CVE-2026-42897","url":"https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4521447","by":"Microsoft","date":"2026-07-14"},{"kind":"advisory","title":"Microsoft CVE record and CISA exploitation entry for CVE-2026-42897","url":"https://vulnerability.circl.lu/vuln/CVE-2026-42897","by":"Microsoft and CISA, republished by CIRCL","date":"2026-08-10"},{"kind":"post","title":"Released: June 2026 Exchange Server Security Updates — Microsoft clarification","url":"https://techcommunity.microsoft.com/blog/exchange/released-june-2026-exchange-server-security-updates/4524491/replies/4527234","by":"Microsoft","date":"2026-06-09"},{"kind":"advisory","title":"Microsoft Releases Security Advisory for a Zero-Day Vulnerability in Exchange Server","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4785","by":"NHS England","date":"2026-06-11"},{"kind":"news","title":"Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild","url":"https://www.securityweek.com/microsoft-warns-of-exchange-server-zero-day-exploited-in-the-wild/","by":"SecurityWeek","date":"2026-05-15"},{"kind":"research","title":"Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit","url":"https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit","by":"Proofpoint","date":"2026-07-29"}],"started":"2026-05-14","closed":"2026-07-29","created":"2026-11-03T22:28:01.378Z","updated":"2026-11-03T22:28:01.378Z","cve_notes":[{"cve":"CVE-2026-42897","name":"Cross-site scripting in Exchange Outlook Web Access","what":"Exchange Outlook Web Access mishandles email content, allowing an unauthenticated attacker to send a crafted message that, when opened under certain interaction conditions, runs JavaScript in the recipient's signed-in browser session.","severity":"high","cvss":8.1}],"timeline":[{"at":"2026-07-29","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Proofpoint published its investigation of the OWAReaper malware used in the campaign. It warned that mailbox access could survive password changes and device rebuilding, and recommended auditing and removing unauthorised mailbox permissions, tokens and browser persistence.","url":"https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit","by":"Proofpoint","patch":null},{"at":"2026-07-22","added":"2026-11-03T22:22:59.664Z","kind":"wider-attacks","text":"Proofpoint observed a new campaign exploiting the flaw, attributed to Russia-aligned TA488, also called Laundry Bear or Void Blizzard. Targets included US and European government bodies and telecommunications, finance, hospitality and aerospace organisations.","url":"https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit","by":"Proofpoint","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Microsoft revised its guidance: after installing the July security update, administrators no longer needed to keep the CVE-2026-42897 mitigation.","url":"https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4521447","by":"Microsoft","patch":null},{"at":"2026-06-09","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Microsoft released June security updates for Exchange Server 2016, 2019 and Subscription Edition. Microsoft confirmed that these fixed CVE-2026-42897, while recommending that administrators retain the mitigation as an additional precaution.","url":"https://techcommunity.microsoft.com/blog/exchange/released-june-2026-exchange-server-security-updates/4524491/replies/4527234","by":"Microsoft","patch":"patched"},{"at":"2026-05-15","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to apply Microsoft's mitigations by 29 May. Whether ransomware campaigns used it was unknown.","url":"https://vulnerability.circl.lu/vuln/CVE-2026-42897","by":"CISA, republished by CIRCL","patch":null},{"at":"2026-05-14","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Microsoft disclosed CVE-2026-42897, an actively exploited flaw in Exchange Server's Outlook Web Access. Emergency mitigations were available, but a software fix had not yet been released.","url":"https://www.securityweek.com/microsoft-warns-of-exchange-server-zero-day-exploited-in-the-wild/","by":"SecurityWeek","patch":"none"}],"url":"https://hard.fyi/live/exchange-owa-xss-attacks-may-2026/","json":"https://hard.fyi/api/live?id=exchange-owa-xss-attacks-may-2026"}