Reported by 5 outlets
Microsoft Exchange Server Zero-Day CVE-2026-42897 — Active OWA Spoofing, No Permanent Patch
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-42897 is a CWE-79 cross-site scripting flaw in the HTML sanitization of Outlook Web Access on-premises, affecting Exchange Server 2016, 2019, and Subscription Edition while Exchange Online stays unaffected. Microsoft scored it CVSS 3.1 8.1 (temporal 7.5, vector AV:N/AC:L/PR:N/UI:R) and published the advisory on May 14, 2026 with the Exploitation Detected flag already set. The exploit is a half-click attack: an unauthenticated attacker sends one crafted email and opening it in OWA runs arbitrary JavaScript in the victim's authenticated browser session, no attachment or link click required. Proofpoint attributes the in-the-wild use, which predated the patch, to the Russian state-sponsored group Laundry Bear (Void Blizzard), which installed OWAReaper, a backdoor with persistent read, write, and exfiltration access to the mailbox.
Treat this as mailbox compromise, not a browser nuisance, because the JavaScript executes inside the OWA session where the victim's full correspondence, attachments, and any approvals or credentials that live in mail are reachable, and OWAReaper's persistence keeps that access alive after the tab closes. The target set Proofpoint documented, government entities in the US and Europe plus telecom, financial, hospitality, and aerospace firms, reads like a collection list rather than opportunistic spraying. What lifts this above the day's other Exchange noise is the delivery property: the email itself is the weapon, so gateway inspection and domain reputation see an ordinary inbound message while the compromise happens inside a trusted, authenticated application, a pattern that defeats the phishing controls most victims have already bought. History argues against filing this as niche tradecraft: CISA has added twenty Exchange Server CVEs to KEV over five years and ransomware gangs exploited fourteen of them.
Confirm the build numbers Microsoft lists for this CVE: 15.02.2562.043 on Subscription Edition RTM (KB5094139), 15.02.1748.046 on Exchange 2019 CU15 (KB5094140), 15.02.1544.041 on 2019 CU14 (KB5094142), and 15.01.2507.069 on 2016 CU23 (KB5094144). The June 2026 security updates carry the permanent fix, and MSRC's July 14 revision recommends the July 2026 updates, which also cover the related CVE-2026-55008, after which the EEMS and EOMT mitigations can be removed. Until every server is patched, keep the Exchange Emergency Mitigation Service enabled so the URL Rewrite rule stays in place, run the EOMT script against air-gapped estates, and block IE and Edge IE Mode for OWA because neither supports the CSP that blunts the payload. Federal agencies were on a BOD 22-01 clock from the May 15 KEV addition, due May 29. Exploitation predated the May 14 advisory, so hunt backward through OWA and front-end IIS logs for anomalous JavaScript execution and audit mailboxes for bulk reads, exports, or message modifications matching OWAReaper behavior, with gateway rules that flag XSS payloads in HTML mail bodies as the inbound compensating control.
Two developments would change the assessment. Ransomware pickup is the first: the KEV entry lists known ransomware campaign use as Unknown, and with fourteen of twenty prior Exchange KEV bugs landing in ransomware kits, commodity delivery of an OWAReaper-class tool would turn a targeted espionage event into a mass one. The second is tradecraft spread: if Proofpoint's reporting pushes the half-click XSS pattern into other groups' playbooks, or Laundry Bear rotates back to Zimbra, where the same crew ran CVE-2025-66376 to deliver ZimReaper, the lesson stops being one CVE and becomes a reusable class against any webmail client that sanitizes HTML poorly.
Timeline
-
original reporting
Microsoft Exchange Server Zero-Day CVE-2026-42897 — Active OWA Spoofing, No Permanent Patch
securityweek.com · 151d ago · May 16th, 2026
Just 48 hours after Microsoft's first zero-day-free Patch Tuesday in nearly two years, a new actively exploited zero-day in on-premises Exchange Server was disclosed. CVE-2026-42897 (CVSS 8.1) is a cross-site scripting flaw in Outlook Web Access that allows an attacker to send a crafted email which executes arbitrary JavaScript in the victim's browser when opened under certain conditions. Exploitation has been confirmed in the wild — Microsoft has not disclosed the threat actor, targets, or campaign scale. Exchange Server 2016, 2019, and Subscription Edition are affected; Exchange Online is not. No permanent patch exists. Microsoft's emergency mitigation: enable the Exchange Emergency Mitigation Service (EEMS), which applies URL Rewrite protection automatically. For air-gapped environments, deploy the Exchange On-premises Mitigation Tool (EOMT). The speed with which this emerged after Patch Tuesday — and the attacker's choice to bypass server-side exploitation in favor of client-side JavaScript execution — suggests sophisticated targeting of OWA users.
-
update from msrc.microsoft.com
CVE-2026-42897 | Microsoft Exchange Server Spoofing Vulnerability
msrc.microsoft.com · 153d ago · May 14th, 2026
Microsoft released the MSRC advisory for CVE-2026-42897 on May 14, 2026, rating it Critical for spoofing (CWE-79) with a CVSS 3.1 base score of 8.1 and marking Exploited: Yes with an Exploitation Detected assessment. The FAQ describes exploitation via a specially crafted email opened in OWA and notes Internet Explorer and Edge in IE Mode are not protected because they do not support CSP. The page lists security updates for Exchange Server Subscription Edition RTM (KB5094139), Exchange 2019 CU15 and CU14 (KB5094140, KB5094142), and Exchange 2016 CU23 (KB5094144), with EEMS applying the mitigation automatically.
-
update from techcommunity.microsoft.com
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
techcommunity.microsoft.com · 153d ago · May 14th, 2026
The Exchange Team published this blog post on May 14, 2026 as the official mitigation guidance for CVE-2026-42897. Microsoft links to it directly from the MSRC advisory FAQ for instructions on protecting Exchange Server, pointing admins to the Exchange Emergency Mitigation Service.
-
update from cisa.gov
Known Exploited Vulnerabilities Catalog entry for CVE-2026-42897
cisa.gov · 152d ago · May 15th, 2026
CISA's KEV feed records CVE-2026-42897, Microsoft Exchange Server Cross-Site Scripting Vulnerability, as added May 15, 2026 with a required-action due date of May 29, 2026 for federal agencies under BOD 22-01. The entry lists CWE-79, cites the Outlook Web Access JavaScript execution vector, and marks known ransomware campaign use as Unknown.
-
update from bleepingcomputer.com
Microsoft Patches Actively Exploited Exchange Server Zero-Day (CVE-2026-42897) — XSS in Outlook Web Access, CISA KEV Since May 15
bleepingcomputer.com · 125d ago · June 11th, 2026
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser context by sending a specially crafted email — no user interaction beyond opening the message in OWA. Microsoft had deployed an automatic temporary mitigation via the Exchange Emergency Mitigation Service (EEMS) in mid-May. The June 2026 security updates provide a permanent fix. Twenty Exchange Server CVEs have been added to CISA's KEV catalog over the past five years, with ransomware gangs exploiting 14 of them.
-
update from bleepingcomputer.com
Russian State Hackers Exploit Exchange OWA Zero-Day (CVE-2026-42897) to Deploy OWAReaper Backdoor
bleepingcomputer.com · 76d ago · July 30th, 2026
Russian state-sponsored threat group Laundry Bear (aka Void Blizzard) is actively exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange Outlook Web Access, to deliver a sophisticated backdoor called OWAReaper — a significant escalation in the group's tradecraft. Technical details:
-
Vector: A "half-click exploit" — users only need to open a specially crafted email in OWA to trigger arbitrary JavaScript execution in the browser context
-
CVE-2026-42897: An XSS flaw in OWA's HTML sanitization, originally patched by Microsoft on May 14, 2026; Laundry Bear was already exploiting it before the patch shipped
-
Malware: OWAReaper provides persistent mailbox access, capable of reading, exfiltrating, and manipulating email content
Targeting: Government entities in the U.S. and Europe, plus companies in telecommunications, financial, hospitality, and aerospace sectors. Proofpoint spotted the activity a week ago and documented it today. Context:
-
Same group previously exploited CVE-2025-66376 as a zero-day in Zimbra email servers to deliver ZimReaper malware (covered in prior digests Jul 22-24)
-
Proofpoint describes this as "a significant improvement in the group's tradecraft and capability" — the OWA half-click exploit approach bypasses conventional phishing defenses because the email itself is the weapon, not an attachment or link
Action: Ensure the May 14, 2026 Exchange OWA patch is applied. Monitor OWA logs for anomalous JavaScript execution. Deploy email security controls that can detect and block XSS payloads within HTML email bodies.
-