CVE-2026-42897 under active exploitation by TA488 for OWAReaper implant

TA488, tracked by Proofpoint as Laundry Bear and Void Blizzard, shifted from its July Zimbra zero-day campaign to CVE-2026-42897 after Microsoft issued mitigation guidance in May and a patch in July. The group sends emails containing embedded HTML that triggers cross-site scripting, installing a custom browser extension granting persistent OWA session access and credential theft without further clicks. Proofpoint described the resulting OWAReaper implant as the most advanced half-click backdoor it has recorded.

Microsoft assigned the flaw its highest severity rating because improper HTML filtering in Outlook Web Access permits arbitrary JavaScript execution. Joint Proofpoint-NSA reporting confirms the same actor used an analogous zero-day against Zimbra customers weeks earlier, indicating coordinated targeting of on-premises mail platforms. Telemetry shows successful compromise of organizations that delayed July patching, with stolen credentials enabling lateral movement.

Unpatched Exchange deployments now face elevated risk of state-sponsored persistence that bypasses traditional endpoint detection. Operators must verify July updates are applied and monitor OWA logs for anomalous JavaScript activity. Continued half-click tradecraft improvements by TA488 suggest similar flaws in other mail servers will be tested rapidly.