CVE-2026-42897 is an XSS vulnerability in Outlook Web Access of Microsoft Exchange Server 2016 CU23 (version 15.01.0.0). The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of the victim's browser by exploiting improper input neutralization during web page generation. The Russia-aligned threat actor TA488 has exploited this vulnerability in a campaign starting July 22, 2026, targeting government and critical infrastructure sectors in the US and Europe. The exploit delivers OWAReaper, a novel JavaScript implant that persists through browser restarts, credential rotations, and device re-imaging by leveraging localStorage, OAuth token theft, and Exchange folder permission modifications. The implant communicates via covert channels including GitHub commit messages and inbound emails, and exfiltrates data over HTTP and DNS. The vulnerability was patched by Microsoft with an official fix, and the vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897.

Successful exploitation results in high-impact consequences including full compromise of Outlook Web Access sessions, credential theft, persistent implant installation, and covert data exfiltration. The attacker gains persistent browser-level access to OWA, bypassing common remediation steps such as credential rotation and device re-imaging. This enables long-term espionage and data theft from targeted organizations in government and critical sectors. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impacts.

An official fix is available from Microsoft for this vulnerability. Organizations using Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0) should apply the vendor-provided patch immediately. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 provides detailed remediation instructions. Since this is not a cloud service, patching the affected on-premises servers is required to mitigate the threat. No additional mitigation steps are indicated beyond applying the official fix.