CVE-2026-42897: Laundry Bear Installs OWAReaper in Exchange OWA

Published on 7 August 2026

A single email opened in a browser – that's all it takes for attackers to gain permanent access to your entire mailbox. No attachment needs to be clicked, no link opened, no password revealed. Simply viewing the crafted message in the Outlook Web Access preview pane is enough. This is exactly the scenario the Russian hacking group Laundry Bear is currently exploiting in the wild – and the backdoor it plants survives even password resets and complete server reinstallations.

If your company runs its own Microsoft Exchange Server and employees access their mailboxes via Outlook Web Access (browser-based access to email), you should read this article now – and then act.

What happened?

The Russian APT group Laundry Bear – also known as Void Blizzard or TA488 – has been running a broad-based attack campaign against Microsoft Exchange Servers since late July 2026. (APT stands for "Advanced Persistent Threat", meaning a professional, usually state-backed attacker aiming for long-term, undetected access.)

In these attacks, the perpetrators exploit the security vulnerability CVE-2026-42897, a so-called cross-site scripting flaw (XSS – a vulnerability that allows foreign program code to be executed in the victim's browser) in Outlook Web Access (OWA). The vulnerability has a CVSS score of 8.1 and is therefore classed as highly dangerous.

Through the vulnerability, the attackers plant a highly complex backdoor called OWAReaper. A backdoor is a hidden entry point that lets attackers access a system permanently and undetected. OWAReaper steals credentials and OAuth tokens (digital access keys that replace re-entering a password) and establishes persistent access that remains in place even after password changes and a complete reinstallation.

According to the security researchers, the primary targets are government agencies as well as companies in the telecommunications, finance, aviation and hospitality sectors in Europe and the United States. Microsoft already provided patches back in June 2026 – yet many servers remain unpatched to this day.

The technical background – explained clearly

The vulnerability arises because Outlook Web Access does not adequately "sanitise" HTML content in emails. Specifically, it affects so-called @import directives in CSS – a formatting command originally intended to load design templates. The attackers hide a Base64-encoded (i.e. obfuscated) JavaScript command inside it.

As soon as the victim opens the manipulated email in OWA – security researchers speak of a "half-click" exploit, precisely because no full click on a link or attachment is required – the malicious script executes and downloads the OWAReaper backdoor.

What makes this backdoor so dangerous is its sophistication:

• It deletes the original attack email to cover its tracks.
• It captures credentials via invisible input fields that abuse the browser's automatic fill function (autofill).
• It stores itself in encrypted form in the browser's localStorage and offline cache (IndexedDB) – i.e. in storage areas that persist even after a restart.
• It searches for installed Outlook add-ins with far-reaching privileges (ReadWriteMailbox), steals their access keys, and – via the Exchange interface – grants the "Default" user Owner rights to all mail folders.

This last point is the crucial one: because the "Default" user is a standard placeholder for every authenticated user in the organisation, virtually any logged-in account can then access the mailbox. And because this permission is anchored server-side, neither a password change nor rebuilding the endpoint device helps.

The Proofpoint Threat Research team sums it up as follows:

"OWAReaper is the most sophisticated backdoor delivered via half-click exploits that Proofpoint has observed to date – primarily due to its collection of subtle persistence mechanisms." (Proofpoint Threat Research Team)

And the security firm BlackSwan Cybersecurity issues an urgent warning:

"Resetting credentials and rebuilding endpoints do not remove the attacker. The persistence lives on the Exchange server and in the browser environment. Organisations relying solely on password changes or device hygiene remain at risk." (BlackSwan Cybersecurity)

To disguise itself, OWAReaper uses unusual communication channels: the malware receives commands via GitHub commit messages or hidden incoming emails, and exfiltrates stolen data via legitimate image CDNs over HTTPS or – as a fallback option – via DNS tunneling (a technique that hides data in seemingly harmless DNS queries).

Who is affected?

At risk are all organisations that run their own (on-premises) Microsoft Exchange Server with Outlook Web Access enabled and have not yet installed the June 2026 security update (or newer).

The situation in Germany is particularly alarming. According to the German Federal Office for Information Security (BSI), an estimated 33,000 Exchange servers are reachable over the internet in the country. Of these, around 92 percent (about 30,360 servers) run on the outdated versions Exchange 2016 or 2019, whose regular support ended in October 2025.

This means: without a paid Extended Security Update subscription (ESU), these servers no longer receive any security patches at all – leaving them defenceless against Laundry Bear's attacks. The security updates for Exchange 2016 and 2019 are available only to customers in the ESU programme (Period 2).

The BSI has been warning about this danger in general terms for some time:

"Should a critical vulnerability in Microsoft Exchange become known in the near future – as has happened several times in recent years – it may not be possible to fix it with a security update. The affected Exchange servers may then have to be taken offline immediately to prevent a compromise." (BSI)

How to check whether you are affected

Work through the following steps – ideally together with your IT service provider or administrator:

1. Check the patch status: Use the official Microsoft script ExchangeHealthChecker.ps1 (Exchange Server Health Checker) to determine whether your servers are up to date on patches.
2. Review folder permissions: Check the permissions of the Exchange mailboxes for unusual Owner rights – particularly for the "Default" user. This is one of the clearest signs of a compromise.
3. Check add-ins and tokens: Review installed Outlook add-ins and their permissions (especially ReadWriteMailbox) as well as the associated access keys of the Exchange Web Services (EWS).
4. Analyse network traffic: Check outbound traffic for connections to known command-and-control domains used by the attackers, including asecdns.com, acocdn.com, dnsrecursive.eu and tdndns.com.

What you need to do now

Act immediately – the attacks are ongoing. The following steps should be worked through in order of priority:

1. Install the security update: Immediately apply the latest security update (at least the June 2026 SU) for your Exchange Server. For Exchange 2016/2019 you need an active ESU subscription for this.
2. Activate emergency mitigation: If immediate patching is not possible, enable the Exchange Emergency Mitigation (EM) Service or apply the EOMT script provided by Microsoft to activate the temporary protective measure M2.1.x.
3. Clean up browser storage if compromise is suspected: Delete the OWA offline cache (IndexedDB) and the localStorage – specifically the entry PageDataPayload.OwaUserDefaultSettings – on the endpoints of the affected users.
4. Reset access: Revoke compromised OAuth tokens, remove unlawfully set folder permissions on the Exchange Server, and force a password change for the affected accounts. Important: a password change alone is not enough – the server-side permissions must be cleaned up without fail.

Context and GDPR: why this is more than an IT problem

A compromise by OWAReaper potentially means the complete loss of confidentiality of all emails and contacts in the affected mailboxes. And emails almost always contain a wealth of personal data: names, addresses, communication content, contracts and sometimes even health data.

This constitutes a serious data breach within the meaning of Art. 4(12) GDPR – a "breach of the security of personal data". As a company, this gives rise to specific legal obligations for you:

• Notification of the supervisory authority: Under Art. 33 GDPR, the incident must be reported to the competent data protection supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of it.
• Notification of the data subjects: Where there is a high risk to the rights and freedoms of the affected individuals, they must also be informed under Art. 34 GDPR.

Anyone who fails to comply with this notification obligation or – for instance through inadequate patch management – has not taken sufficient technical and organisational measures (TOMs) under Art. 32 GDPR risks substantial fines of up to 10 million euros or 2 percent of global annual turnover.

Conclusion

CVE-2026-42897 combines several factors that make this threat particularly dangerous: the attack requires hardly any user interaction, the OWAReaper backdoor deployed is exceptionally sophisticated, and it cannot be removed with the usual standard measures such as password changes or device reinstallation. The fact that tens of thousands of Exchange servers in Germany run on outdated versions that are no longer regularly supported makes the situation even more explosive.

The good news: Microsoft already provided the patch back in June 2026. Anyone who is currently patched is protected against this specific attack chain. The decisive question is therefore not whether an update exists, but whether it has actually been installed on your systems.

Check the patch status of your Exchange Server today, review the folder permissions for suspicious "Owner" rights for the "Default" user – and, if in doubt, bring in professional support. With an attacker that embeds itself permanently in the system, every hour counts.