OWA XSS Flaw Lets Russian Hackers Survive Credential Resets
Written by AI from the linked story. Not reviewed by an editor. How this works
Russian threat actor Laundry Bear is exploiting CVE-2026-42897, an unpatched cross-site scripting flaw in Microsoft Outlook Web Access, to deploy a JavaScript backdoor called OWAReaper that persists inside the webmail client even after victims rotate their credentials. This attack is particularly dangerous because credential rotation — a standard incident response procedure — provides no relief once the backdoor is embedded, effectively nullifying one of the most common remediation steps organizations rely on. Compounding the threat, the malware actively rewrites Exchange server emails to erase forensic evidence of the exploit, blinding defenders and hindering investigation. This campaign highlights that unpatched internet-facing webmail infrastructure remains a high-value entry point for nation-state actors targeting government and critical sectors. Organizations cannot rely solely on credential hygiene when client-side persistence mechanisms bypass authentication entirely.
Tactical Insight
Immediate actions
- Apply Microsoft's emergency patch or mitigation for CVE-2026-42897 on all OWA/Exchange instances without delay.
- Take OWA interfaces offline or restrict access to trusted IP ranges until the patch is confirmed deployed.
- Force a full session token invalidation across all active OWA sessions, not just credential rotation, to evict any live backdoor sessions.
Detection measures
- Hunt for anomalous JavaScript execution or unexpected script tags within OWA mailbox content using SIEM rules tuned to Exchange audit logs.
- Enable and review Exchange mailbox audit logging for email modification or deletion events that could indicate OWAReaper's evidence-wiping behavior.
- Deploy a Web Application Firewall (WAF) with XSS detection rules in front of OWA to block or alert on half-click exploit patterns.
Long-term improvements
- Establish an emergency patching SLA of 24–48 hours for critical vulnerabilities affecting internet-facing authentication portals.
- Implement immutable, out-of-band log archiving for Exchange audit trails so malware cannot tamper with forensic evidence.
- Adopt a Zero Trust architecture requiring continuous re-validation of session context, making client-side persistence harder to sustain silently.