THREATNOIR
Subscribe
Back to advisories

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

Russian state-sponsored group Laundry Bear is actively exploiting a zero-day XSS vulnerability (CVE-2026-42897) in Exchange OWA to deploy OWAReaper backdoor. Targets include U.S. and European government entities and private sector organizations. Successful exploitation grants persistent mailbox access and enables credential harvesting.

CRITICALAdvisoryJul 31, 2026
Action required
Immediately scan all Exchange OWA servers for CVE-2026-42897 exploitation. Review OWA access logs for suspicious XSS payloads and unusual mailbox forwarding rules. If vulnerable, isolate affected servers and coordinate with Microsoft for emergency patching.
Affected products
Exchange Outlook Web AccessZimbra email serversMicrosoft
CVE IDs
CVE-2026-42897
Linked articles
Source links