Microsoft Exchange Outlook Web Access flaw CVE-2026-42897 exploited for persistent mailbox access
Attackers used malicious emails to compromise people reading mail through vulnerable Exchange Outlook Web Access servers. Fixes are available. Ask your email administrator to install current Exchange updates and check for persistent mailbox access.
If your work or family office runs its own Exchange email server, ask its IT provider to install the latest applicable Exchange security updates, including the July 2026 update or later, and investigate possible OWAReaper access. Suspected compromises need mailbox permissions, tokens and browser storage checked; changing a password alone is insufficient. Exchange Online users have no update to install for this flaw.
What’s happening
CVE-2026-42897 affects Outlook Web Access on organisations' own Microsoft Exchange servers, including Exchange 2016, 2019 and Subscription Edition. Opening a specially crafted email, under Microsoft's stated interaction conditions, can let an attacker run JavaScript inside the user's signed-in browser session. Exchange Online is unaffected. Microsoft disclosed active exploitation on 14 May, initially offering emergency mitigations. June security updates fixed the vulnerability; July updates removed Microsoft's recommendation to retain the mitigation. In July, Proofpoint observed Russia-aligned TA488 using the flaw to deliver OWAReaper against government bodies and several business sectors. The malware could steal credentials and tokens and change mailbox permissions to preserve access despite password changes or device rebuilding. Compromised organisations therefore need investigation and clean-up alongside patching. Microsoft rates the flaw high, with CVSS 8.1; NVD's separate assessment is 6.1. The reviewed reporting does not establish that the attacks have ended.
- What
- Flaw
- Affects
- Microsoft Exchange Server 2016, 2019 and Subscription Edition — Outlook Web Access
- Affected
- Microsoft Exchange Server 2016 Cumulative Update 23: versions from 15.01.0.0 below 15.01.2507.069
Microsoft Exchange Server 2019 Cumulative Update 14: versions from 15.02.0.0 below 15.02.1544.041
Microsoft Exchange Server 2019 Cumulative Update 15: versions from 15.02.0.0 below 15.02.1748.046
Microsoft Exchange Server Subscription Edition RTM: versions from 15.02.0.0 below 15.02.2562.043 - Fixed in
- Microsoft Exchange Server 2016 Cumulative Update 23: 15.01.2507.069
Microsoft Exchange Server 2019 Cumulative Update 14: 15.02.1544.041
Microsoft Exchange Server 2019 Cumulative Update 15: 15.02.1748.046
Microsoft Exchange Server Subscription Edition RTM: 15.02.2562.043 - Since
- 14 May 2026
- Closed
- 29 July 2026
Timeline
- Update
Proofpoint published its investigation of the OWAReaper malware used in the campaign. It warned that mailbox access could survive password changes and device rebuilding, and recommended auditing and removing unauthorised mailbox permissions, tokens and browser persistence.
- Wider attacks
Proofpoint observed a new campaign exploiting the flaw, attributed to Russia-aligned TA488, also called Laundry Bear or Void Blizzard. Targets included US and European government bodies and telecommunications, finance, hospitality and aerospace organisations.
- Vendor revised
Microsoft revised its guidance: after installing the July security update, administrators no longer needed to keep the CVE-2026-42897 mitigation.
- New fixFixed
Microsoft released June security updates for Exchange Server 2016, 2019 and Subscription Edition. Microsoft confirmed that these fixed CVE-2026-42897, while recommending that administrators retain the mitigation as an additional precaution.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to apply Microsoft's mitigations by 29 May. Whether ransomware campaigns used it was unknown.
- Made publicNo fix yet
Microsoft disclosed CVE-2026-42897, an actively exploited flaw in Exchange Server's Outlook Web Access. Emergency mitigations were available, but a software fix had not yet been released.
Sources
- Addressing Exchange Server May 2026 vulnerability CVE-2026-42897Microsoft · 14 July 2026
- Microsoft CVE record and CISA exploitation entry for CVE-2026-42897Microsoft and CISA, republished by CIRCL · 10 Aug 2026
- Released: June 2026 Exchange Server Security Updates — Microsoft clarificationMicrosoft · 9 June 2026
- Microsoft Releases Security Advisory for a Zero-Day Vulnerability in Exchange ServerNHS England · 11 June 2026
- Microsoft Warns of Exchange Server Zero-Day Exploited in the WildSecurityWeek · 15 May 2026
- Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click ExploitProofpoint · 29 July 2026