Email-server compromise enables mailbox theft and phishing delivery
Key Questions
What vulnerabilities are being actively exploited in Exchange Server?
The exploitation involves CVE-2026-42897, an XSS flaw in Outlook Web App (OWA) triggered by a single crafted email with no attachments or spoofing, along with CVE-2026-6973 enabling remote code execution. These zero-days target on-premises Exchange deployments.
What mitigation steps and deadlines have been issued for these Exchange vulnerabilities?
An emergency mitigation was released on May 14, and the issues are listed in CISA's Known Exploited Vulnerabilities catalog with a federal patch deadline of May 29. No official patch is available yet, though the advisory outlines technical details and recommended actions.
Which organizations face heightened risks from this Exchange exploitation?
On-premises finance organizations are at elevated risk of post-phish escalation. The advisory also notes mentions of APT37 deepfakes and OWA CVEs in strategic briefings, along with a recommendation to disable SVG in Outlook.
Exchange CVE-2026-42897 and CVE-2026-6973 remain associated with Laundry Bear/TA488 exploitation, OWAReaper persistence, OAuth-token theft, add-in abuse, and SVG evasion. Reported Zimbra and Roundcube crafted-email exploitation adds possible unauthenticated RCE, web shells, persistence, mailbox theft, and credential collection, but affected versions and exploitation scope remain partly uncertain.