Russian Hackers Exploit Microsoft OWA Flaw to Retain Mailbox Access After Credential Rotation
What Happened — Researchers observed a Russian‑linked group leveraging a newly‑disclosed Microsoft Outlook Web Access (OWA) vulnerability to maintain persistent access to user mailboxes even after the compromised credentials were rotated. The campaign, active since 22 July 2026, targeted U.S. and European government agencies and organizations in telecommunications, financial services, hospitality, and aerospace.
Why It Matters for Compliance & Audit Readiness
- The attack demonstrates how a single application‑level flaw can bypass credential‑rotation controls that are a core requirement of SOC 2 CC 6.2 (Logical Access).
- Continuous monitoring of privileged‑access sessions and immutable audit logs is essential to prove that access revocation actually took effect.
- Mapping this scenario to Verisq’s SOC 2 Access Controls capability provides the evidence‑collection framework needed for a defensible audit trail.
Who Is Affected – Government, telecom, finance, hospitality, and aerospace entities that expose OWA to external users.
Recommended Actions
- Verify that all OWA servers are patched to the latest Microsoft security update (released 24 July 2026).
- Enable MFA for OWA and enforce session‑termination policies that invalidate active tokens on credential change.
- Deploy continuous session‑monitoring tools that capture authentication events and retain them for the SOC 2 audit period.
- Review and update your logical‑access policies to include “post‑rotation token revocation” as a control objective.
Technical Notes – The vulnerability (CVE‑2026‑XXXX) allowed an attacker with a valid mailbox token to request a new token after password change, effectively bypassing the rotation. Exploitation required a valid OWA session and leveraged an authentication‑bypass flaw in the token‑refresh endpoint. Source: The Hacker News