Russia-affiliated threat group Laundry Bear (aka Void Blizzard, TA488) is actively exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange’s Outlook Web Access (OWA) interface. The attack requires zero user interaction beyond opening an email — no clicks, no attachments, no macros. Simply viewing the message in OWA triggers the exploit.

What Happened

Proofpoint researchers disclosed on July 30, 2026 that Laundry Bear has been targeting U.S. and European government entities and private-sector organizations since at least March 2026. The exploit delivers OWAReaper, a persistent backdoor that lives entirely in the Exchange server and the victim’s browser storage — surviving device reimaging, credential rotation, and even full mailbox migrations.

Microsoft patched CVE-2026-42897 in June 2026 after providing a temporary mitigation in May. However, Proofpoint’s timeline analysis shows the threat actor’s infrastructure was created in March 2026 — two months before the out-of-band patch — indicating likely zero-day exploitation.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-42897
Component	Microsoft Exchange Server (OWA webmail interface)
Vulnerability Type	Cross-Site Scripting (XSS) in message rendering
Attack Vector	Network — email delivery to victim’s inbox
User Interaction	None required (auto-executes in reading pane)
Privileges Required	None
CVSS Score	Not yet assigned by NVD (Microsoft rated Important)
Patch Date	June 2026 (Microsoft June Patch Tuesday)
Exploitation Status	Active, in-the-wild

The flaw resides in how OWA sanitizes HTML email content before rendering in the reading pane. A carefully crafted message body contains payload blobs that reconstruct a JavaScript loader when processed by Exchange’s rendering engine. The loader executes in the victim’s OWA session context — authenticated as the mailbox owner.

Impact Assessment

This is not a typical XSS. OWAReaper achieves server-side persistence through a novel combination of techniques:

1. Self-cleaning exploit — After execution, the malware rewrites the original email on the server to remove the exploit code, hiding evidence from forensic analysis.

2. Browser storage persistence — An encrypted copy of the backdoor and its decryption wrapper are written to the browser’s IndexedDB storage (OWA’s offline message cache). Every time the victim opens a new OWA tab, the cached script auto-executes.

3. Mailbox permission escalation — OWAReaper enumerates installed Outlook add-ins with ReadWriteMailbox permissions and abuses them to:

   • Steal OAuth tokens
   • Grant Owner permissions on the "Default" user for every mail folder
   • This gives any authenticated user in the organization full mailbox access — a lateral movement primitive that persists even if the original victim’s credentials are rotated.

4. Reinfection via offline cache — A hidden iframe injected into messages in the IndexedDB cache allows reinfection of re-imaged devices when the victim opens a poisoned email from the local cache.

Proofpoint warns: "Credential rotation and even full re-imaging of the targeted user’s device will not evict the actor. This persistent access lives on the server-side and requires deliberate removal from the Exchange server."

Affected Systems

All on-premises Exchange Server versions with OWA enabled are affected:

• Exchange Server 2016 (CU23+)
• Exchange Server 2019 (CU14+)
• Exchange Subscription Edition

Exchange Online (Office 365) customers are protected by Microsoft’s managed patching — no action required.

Mitigation & Patching

Immediate Actions

1. Apply the June 2026 Cumulative Update (CU) for your Exchange version. This is the definitive fix.

2. If immediate patching is impossible, deploy Microsoft’s May 2026 temporary mitigation:

   powershell

3. Block known IoCs at network perimeter (see Proofpoint’s blog for IP/domains).

Compromise Assessment

If you suspect targeting, perform this multi-step cleanup (all steps required):

1. Endpoints: Re-image or forensic wipe all devices that accessed the compromised mailbox.
2. Exchange Server:
   • Remove malicious IndexedDB entries from affected mailboxes
   • Audit and revoke ReadWriteMailbox add-in permissions
   • Reset Default user permissions on all mail folders
   • Rotate all OAuth tokens and service principal secrets
3. Identity: Force password reset for compromised account; review sign-in logs for anomalous access.

Detection Guidance

Indicator	Detection Method
OWAReaper script in IndexedDB	Browser forensics / EDR script block logging
Email Body property rewritten	Exchange message tracking logs (Event 1036)
ReadWriteMailbox add-in abuse	Azure AD / Entra ID audit logs (consent grants)
Owner permission added to Default user	Get-MailboxFolderPermission PowerShell audit
GitHub/GitLab commit fetches from OWA process	Network proxy / firewall logs (user-agent: OWA)
DNS/HTTPS exfiltration from browser context	DNS firewall, TLS inspection

YARA Rule (OWAReaper loader pattern):

rule OWAReaper_Loader { meta: description = "Detects OWAReaper JavaScript loader reconstruction" author = "Proofpoint / Aiyu Blog" date = "2026-07-30" strings: $blob1 = /payload_[a-f0-9]{32}/ $reconstruct = "Function.prototype.constructor" nocase $indexeddb = "indexedDB.open" nocase condition: all of them }

Sigma Rule (Exchange mailbox permission anomaly):

Frequently Asked Questions

Q: Does this affect Exchange Online / Microsoft 365? A: No. Microsoft applies patches to the cloud service automatically. Only on-premises Exchange servers require manual updates.

Q: Can antivirus/EDR catch OWAReaper? A: Traditional file-based AV cannot — the payload never touches disk. It executes entirely in browser memory and IndexedDB. Behavioral EDR with script-blocking (AMSI, PowerShell Script Block Logging) may detect the loader reconstruction.

Q: Is there a workaround that doesn't break OWA? A: No supported workaround preserves full OWA functionality. The May mitigation disables the reading pane. Patching is the only complete fix.

Q: How do I know if my organization was targeted? A: Check for the IoCs in Proofpoint’s advisory. Run the Sigma/YARA rules above. Audit mailbox permissions for unauthorized Default user Owner grants.

Q: What makes this different from other Exchange XSS flaws? A: The server-side persistence via mailbox permission manipulation and browser cache reinfection chain. Most XSS is ephemeral; this survives remediation.

Key Takeaways

• CVE-2026-42897 is actively exploited by a nation-state APT (Laundry Bear / TA488) against government and enterprise targets.
• Zero-click exploitation: Opening the email in OWA reading pane is sufficient — no attachment, no link click.
• Persistence survives reimaging: The backdoor lives in Exchange server state and browser IndexedDB, not on the endpoint.
• Lateral movement via mailbox permissions: Any user in the org gains full mailbox access once Default gets Owner rights.
• Patch immediately: June 2026 CU is the only complete fix. No workaround preserves OWA functionality.
• Assume compromise if unpatched since March 2026: Threat actor infrastructure predates the patch by two months.

---

Sources: Proofpoint Threat Insight, Help Net Security, Microsoft Security Advisory