Exchange OWA CVE-2026-42897: patch your mail server

Proofpoint published research this week on a live campaign exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access, to install a browser-resident backdoor called OWAReaper. The part that should get your attention: OWAReaper establishes persistence through Exchange mailbox permissions, so resetting the victim's password does nothing. If you still run Exchange on your own hardware, this is your week.

What actually happened

Per Proofpoint's writeup, the Russian-aligned actor TA488 (also tracked as Laundry Bear and Void Blizzard) began a campaign on July 22 using compromised email accounts to send innocuous-looking messages — no links, no attachments, no call to action. Subject lines referenced semiconductor supply chains, gas markets, and tourism metrics. Targets spanned US and European government, telecom, finance, hospitality, and aerospace.

Opening the message in a vulnerable OWA session is the whole attack — Proofpoint calls it a half-click exploit. An onload handler fires a small JavaScript loader that reassembles payload fragments hidden inside social-media icon elements in the email body. The result runs inside the victim's authenticated browser session.

OWAReaper then harvests credentials through invisible DOM elements, injects iframes into cached mail, and grants Exchange folder permissions to the Default user for persistence. It rotates command-and-control across GitHub commit messages, email, CDNs, and DNS tunneling.

Microsoft's guidance rates the bug CVSS 8.1, flags it as exploitation detected, and shipped mitigation in May with the security update on June 9, 2026. It affects Exchange Server 2016, 2019, and Subscription Edition. Exchange Online is not affected. Proofpoint notes the earliest attacker infrastructure appeared in March — two months before the patch — which suggests but does not confirm zero-day use.

Why the Exchange OWA flaw matters for your business

Most small businesses moved to Microsoft 365 and are clear here. The ones that aren't clear are the ones who think they are: a hybrid Exchange server left running after migration to handle mail-flow or attribute sync. That box is still on the internet, still serves OWA, and nobody has patched it since the cutover.

Three things to do. Confirm whether any on-prem Exchange server exists in your environment at all — ask your MSP in writing, don't assume. If one does, verify it's past the June 9 update, not just "recently patched." Then audit Exchange folder permissions granted to the Default user across mailboxes, because that's the persistence mechanism and it outlives every credential reset you run.

Sources: Proofpoint, Microsoft Exchange Team Blog.