CISA adds actively exploited Microsoft Exchange Server XSS flaw CVE-2026-42897 to KEV catalog

This article directly updates the same underlying event: active exploitation of CVE-2026-42897 in on-premises Exchange Server OWA. It adds attribution to TA488/Laundry Bear, says the campaign targeted government, telecom, finance, hospitality, and aerospace organizations in the US and Europe, and describes the OWAReaper browser implant and the possibility that exploitation began as early as March, before disclosure and patching.

This article adds concrete attribution and exploitation details to the same CVE-2026-42897 event: Proofpoint says Russia-linked Laundry Bear used the Exchange OWA XSS zero-day to deliver the OWAReaper backdoor, target U.S. and European organizations, and maintain long-term mailbox access through Outlook add-ins even after password rotation or system rebuilds.

This provides attacker attribution and tradecraft for the already tracked exploitation of CVE-2026-42897, identifying Laundry Bear as using the Outlook Web Access flaw in a half-click email theft campaign and deploying the OWAReaper browser implant for persistence.

The article notes that CVE-2026-42897 was the actively exploited zero-day in this Patch Tuesday cycle and reiterates Microsoft's Exchange Emergency Mitigation Service guidance, connecting this patch release to the previously tracked active exploitation.

This article updates the same underlying event by adding that Microsoft has now released patches for the previously mitigations-only zero-day CVE-2026-42897 affecting Exchange Server Subscription Edition, 2016, and 2019.

This article is a direct update to the same CVE-2026-42897 event, adding that Microsoft has now released June 2026 security updates to patch the actively exploited Exchange Server flaw after earlier warning of exploitation and temporary mitigations.

This article is the first tracked item here establishing the specific KEV event for CVE-2026-42897 and its active exploitation status.