Russian Group Exploits Exchange OWA Zero‑Day (CVE‑2026‑42897) for Persistent Mailbox Access
What Happened — The state‑sponsored group Laundry Bear (aka Void Blizzard) is weaponizing CVE‑2026‑42897, an XSS flaw in Microsoft Exchange Outlook Web Access (OWA). By sending specially crafted emails, the attackers trigger JavaScript execution in the victim’s browser, installing the OWAReaper backdoor that provides long‑term mailbox access and can harvest credentials, 2FA codes, and other sensitive data.
Why It Matters for Compliance & Audit Readiness
- The scenario directly tests SOC 2 CC6.1 (Logical Access) and CC6.2 (System Operations) controls that require robust authentication, least‑privilege access, and continuous monitoring of privileged accounts.
- Evidence of timely patch management (CC3.1) and secure configuration of web‑mail services becomes critical audit artifacts when a zero‑day is exploited.
- Demonstrating a documented security‑awareness program (CC1.1) that trains users to recognize “half‑click” phishing attempts helps satisfy the “Security Awareness Training” control set.
Who Is Affected — Government agencies, telecommunications providers, financial institutions, hospitality firms, and aerospace companies that run on Microsoft Exchange Server.
Recommended Actions
- Apply Microsoft’s May 14 2024 advisory patch for CVE‑2026‑42897 immediately.
- Enforce MFA on all OWA accounts and review privileged mailbox access logs for anomalous activity.
- Deploy anti‑phishing email gateways that sandbox HTML content and block embedded scripts.
- Update SOC 2 access‑control policies to include regular OWA configuration reviews and evidence collection for audit. Source: BleepingComputer
Technical Notes — The vulnerability is a cross‑site scripting (XSS) flaw caused by improper HTML sanitization in OWA. Exploit delivers Base64‑encoded JavaScript payloads via social‑icon URLs, establishing the OWAReaper backdoor. CVE‑2026‑42897 has a CVSS v3.1 score of 9.8 (Critical). Source: [Microsoft Advisory]