Skip to content
OriginalSign in
Image: Ars Technica

Ars TechnicaDan Goodin

Russian hackers use Exchange XSS bug to plant OWAReaper

Part of the CVE-2026-42897 story · since 15 May

Quiet for 13 weekslast report 30 Jul14 articles8 outlets
15 May · The Hacker News first9 Aug7 Sep6 OctNowThis article14th of 14
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV. This article, 14th of 14.

Russian state hackers, identified as TA488, are exploiting a critical vulnerability (CVE-2026-42897) in Microsoft's Exchange Server, allowing them to gain unauthorized access to unpatched networks. This vulnerability, described as a cross-site-scripting flaw, lets attackers execute malicious JavaScript simply by having a victim open a malicious email.

TA488 has developed a new backdoor, named OWAReaper, which runs entirely within the Outlook Web Access (OWA) interface, extracting sensitive information like credentials. Microsoft's mitigation advice, released in May and patched in July, aims to address this vulnerability. Proofpoint advises affected users to take immediate action, including audit of tokens and removal of permissions, to neutralize threats.

How the story developed

All 14 articles
Quiet for 13 weekslast report 30 Jul14 articles8 outlets

14 articles from 8 outlets since 15 May. Quiet since 30 Jul. This was the 14th report, 77 days after the first.

Now15 May2226302581128 JulFirst reportThe Hacker News · 15 May, 07:20This article14th of 14 · day 76
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV. This article, 14th of 14.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Fri 15 MayDay 07
    1. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-4289707:20 · The Hacker News · First report · Known exploited CVE
    2. Microsoft warns of zero day Exchange flaw CVE-2026-4289712:10 · SecurityWeek · Known exploited CVE
    3. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog18:20 · CISA · official · CISA alert · Known exploited CVE
    Show 4 more from 15 May
    1. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers12:40 · Infosecurity · Known exploited CVE
    2. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw14:30 · Security Affairs · Known exploited CVE
    3. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch19:20 · CISA · official · Known exploited CVE
    4. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list19:27 · CISA · official · Known exploited CVE
  2. Sat 16 MayDay 11
    1. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list18:21 · Security Affairs · Known exploited CVE

  3. Quiet for 2 days

    Mon 18 MayDay 32
    1. Microsoft Exchange zero day bug exploited in the wild15:42 · The Hacker News · Known exploited CVE
    2. Microsoft Exchange Zero-Day Under Attack, No Patch Available22:12 · Dark Reading · Known exploited CVE

  4. Quiet for 3 weeks

    Thu 11 JunDay 271
    1. Microsoft fixes active Exchange bug CVE-2026-42897.07:07 · SecurityWeek · Picked up again · Known exploited CVE

  5. Quiet for 7 weeks

    Wed 29 JulDay 752
    1. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook14:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. TA488 employs half‑click OWA exploit against government targets15:20 · Infosecurity · Known exploited CVE
  6. Thu 30 JulDay 761
    1. Russian hackers use Exchange XSS bug to plant OWAReaper21:30 · Ars Technica · Known exploited CVE · This article, 14th of 14

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in