Attacker retains mailbox access after credential rotation when a crafted email is opened in Microsoft Exchange Outlook Web Access

Viewed 3

CVE-2026-42897 is an XSS flaw caused by improper HTML sanitization of message bodies in Exchange Server's Outlook Web Access. Merely opening a specially crafted email in OWA ("half-click") executes attacker JavaScript in the victim's browser session.

The Russian-linked group Laundry Bear/TA488 used it to deploy the OWAReaper backdoor, which steals OAuth tokens from Outlook add-ins holding ReadWriteMailbox permissions and calls UpdateFolder to grant the "Default" user Owner-level rights on every mail folder. Because those permissions live server-side, rotating the compromised user's password or re-imaging their machine does not revoke access — and a hidden iframe planted in OWA's offline IndexedDB cache can re-infect a rebuilt host.

Steps to reproduce:

  1. Send a crafted HTML email containing the sanitization-bypassing payload to a target on a vulnerable on-premises Exchange server.
  2. Have the recipient open the message in Outlook Web Access (the reading pane is enough — no attachment or link click required).
  3. Observe the embedded JavaScript execute in the OWA browser session and deploy the backdoor.
  4. Backdoor grants "Default" Owner-level permissions on mail folders and harvests OAuth tokens.
  5. Rotate the victim's credentials and re-image the device — mailbox access via the server-side folder permissions persists.

Workaround: Microsoft published an automatic interim mitigation in May 2026, delivered and enabled automatically for servers with the Exchange Emergency Mitigation (EM) Service enabled. Additional non-patch measures: monitor and revoke OAuth tokens, review mailbox folder permissions for unauthorized Owner assignments, audit installed Outlook add-ins with ReadWriteMailbox permissions, and watch for suspicious IndexedDB cache
modifications.

Severity: Critical (unauthenticated remote code execution in the user's session triggered by merely opening an email, actively exploited as a zero-day by a state-linked actor, and the resulting access survives the standard
incident-response remedies of credential rotation and device re-imaging)
First seen: May 2026 (disclosed 14 May 2026; attacker infrastructure dates to March 2026)
Affected product: Microsoft Exchange Server
Affected platforms: On-premises Windows Server deployments of Exchange. Exchange Online is not affected.
Affected versions: Exchange Server 2016 (CU23), Exchange Server 2019 (CU14, CU15), Exchange Server Subscription Edition
Fixed versions: June 2026 security updates released 9 June 2026 — Exchange Server SE RTM (KB5094139); Exchange Server 2016/2019 fixes available through the ESU program

Links:

1 Answers

Apply the June 9, 2026 Exchange Server security updates, which contain the permanent fix (Exchange Server SE: KB5094139; Exchange Server 2016 CU23 and 2019 CU14/CU15 via the Extended Security Updates program).
Patching alone does not evict an existing intruder — audit and reset mailbox folder permissions (especially Owner rights assigned to "Default"), revoke OAuth tokens and add-in grants, and clear poisoned OWA offline caches.