CVE-2026-42897 is an XSS flaw caused by improper HTML sanitization of message bodies in Exchange Server's Outlook Web Access. Merely opening a specially crafted email in OWA ("half-click") executes attacker JavaScript in the victim's browser session.
The Russian-linked group Laundry Bear/TA488 used it to deploy the OWAReaper backdoor, which steals OAuth tokens from Outlook add-ins holding ReadWriteMailbox permissions and calls UpdateFolder to grant the "Default" user Owner-level rights on every mail folder. Because those permissions live server-side, rotating the compromised user's password or re-imaging their machine does not revoke access — and a hidden iframe planted in OWA's offline IndexedDB cache can re-infect a rebuilt host.
Steps to reproduce:
- Send a crafted HTML email containing the sanitization-bypassing payload to a target on a vulnerable on-premises Exchange server.
- Have the recipient open the message in Outlook Web Access (the reading pane is enough — no attachment or link click required).
- Observe the embedded JavaScript execute in the OWA browser session and deploy the backdoor.
- Backdoor grants "Default" Owner-level permissions on mail folders and harvests OAuth tokens.
- Rotate the victim's credentials and re-image the device — mailbox access via the server-side folder permissions persists.
Workaround: Microsoft published an automatic interim mitigation in May 2026, delivered and enabled automatically for servers with the Exchange Emergency Mitigation (EM) Service enabled. Additional non-patch measures: monitor and revoke OAuth tokens, review mailbox folder permissions for unauthorized Owner assignments, audit installed Outlook add-ins with ReadWriteMailbox permissions, and watch for suspicious IndexedDB cache
modifications.
Severity: Critical (unauthenticated remote code execution in the user's session triggered by merely opening an email, actively exploited as a zero-day by a state-linked actor, and the resulting access survives the standard
incident-response remedies of credential rotation and device re-imaging)
First seen: May 2026 (disclosed 14 May 2026; attacker infrastructure dates to March 2026)
Affected product: Microsoft Exchange Server
Affected platforms: On-premises Windows Server deployments of Exchange. Exchange Online is not affected.
Affected versions: Exchange Server 2016 (CU23), Exchange Server 2019 (CU14, CU15), Exchange Server Subscription Edition
Fixed versions: June 2026 security updates released 9 June 2026 — Exchange Server SE RTM (KB5094139); Exchange Server 2016/2019 fixes available through the ESU program
Links:
- Help Net Security — Unpatched Microsoft Exchange Server vulnerability exploited (15 May 2026)
- Microsoft — Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 (May 2026, not verified)
- Microsoft — Released: June 2026 Exchange Server Security Updates (9 June 2026)
- Microsoft Support — KB5094139, Exchange Server SE RTM security update (9 June 2026)
- BleepingComputer — Russian hackers exploit Exchange OWA zero-day for long-term mailbox access (29 July 2026)
- Proofpoint — Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit (July 2026)
- Help Net Security — Laundry Bear's new Microsoft Exchange attack triggers on email open (30 July 2026)
- The Hacker News — Russian Hackers Exploit Microsoft OWA Flaw (example article) (July 2026)