CVE-2026-42897 — Microsoft Exchange Server OWA Zero-Day

CVE-2026-42897 is an actively exploited zero-day in Microsoft Exchange Server Outlook Web Access (OWA). It is an improper-neutralization (cross-site scripting / spoofing) flaw: an attacker sends a weaponized email, and when a victim opens it in a browser via OWA under certain interaction conditions, attacker-controlled JavaScript executes inside the victim's OWA session. Microsoft rates it CVSS 8.1, Critical and has confirmed active exploitation in the wild. CISA added it to the Known Exploited Vulnerabilities catalog.

The attacker's objective is browser-session / token theft and mailbox access (T1185, T1114): script running in the OWA context can read mail, steal session material, and pivot to OWA mailbox access from anomalous infrastructure. Where a victim has elevated rights or the attacker chains to a follow-on web shell under the Exchange web directories (T1505.003), the on-prem Exchange server itself becomes the foothold — and Exchange servers historically run with high privilege.

Highest-value defensive angle: because no atomic IOCs are published, hunt the behavior on the Exchange box — specifically w3wp.exe (MSExchange app pools) spawning shells/interpreters and new .aspx writes under OWA / HttpProxy / aspnet_client. Those are the loudest signals of the post-XSS pivot regardless of the email payload itself. Pair that EDR hunt with native IIS/HttpProxy OWA-log and message-tracking review for the weaponized-email vector.

Scope: on-prem only — Exchange Server Subscription Edition (SE), Exchange Server 2019, Exchange Server 2016. Exchange Online is not affected. Microsoft shipped Security Updates on 2026-06-09; an interim mitigation (Exchange Emergency Mitigation Service, EEMS) was pushed earlier, and reporting notes mitigation gaps in some configurations.

Defender priority: Apply the June 2026 SU to all on-prem Exchange (SE / 2019 / 2016) immediately, confirm EEMS mitigations are active, then hunt for w3wp.exe child-process execution and unexpected .aspx writes under Exchange web dirs over the last 30–60 days — exploitation predates the patch.

IOC provenance note: As of 2026-06-20 no atomic IOCs (IPs, hashes, filenames, domains) have been publicly published for CVE-2026-42897. This pack ships behavioral signatures only plus REPLACE_WITH_… placeholders. Do not treat any concrete value here as a real-world IOC.

Hunt hypotheses

• H1 — Web-shell pivot: Post-XSS, an operator drops a .aspx web shell under an Exchange web virtual directory (…\FrontEnd\HttpProxy\owa\auth\, …\inetpub\wwwroot\aspnet_client\). Detect anomalous .aspx file writes by IIS/Exchange service accounts.
• H2 — App-pool child process: w3wp.exe running an MSExchange app pool spawns cmd.exe, powershell.exe, cscript.exe or other interpreters — the classic Exchange-exploitation tell.
• H3 — Session/token theft & anomalous mailbox access: OWA session reached from rare/foreign IPs shortly after a crafted email, or token reuse from new geos/ASNs — browser session hijacking (T1185).
• H4 — Outbound C2 from Exchange host: Exchange host processes (w3wp.exe or spawned children) make outbound connections to rare external destinations (T1071).
• H5 — Weaponized-email vector: Inbound mail with HTML/script payloads correlated to OWA render events in message-tracking + HttpProxy logs.

Attack chain

No atomic IOCs published as of 2026-06-20. The rows below are behavioral indicators and placeholders — hunt on behavior, not on the concrete values.

Affected (on-prem only): Exchange Server Subscription Edition (SE), Exchange Server 2019 (CU14 / CU15), Exchange Server 2016 (CU23). Exchange Online is NOT affected.

Checks that don't require EDR — run these against IIS, HttpProxy, message-tracking, and Exchange management logs on each on-prem Exchange server.

IIS / HttpProxy OWA logs

• Parse %ExchangeInstallPath%\Logging\HttpProxy\Owa\*.log and W3SVC IIS logs for OWA requests with unusually long query strings, script-bearing parameters, or requests to non-standard .aspx paths under the OWA virtual directory.
• Flag requests to any .aspx under owa\auth\ or aspnet_client\ that is not part of the shipped Exchange file set.
• Correlate OWA AnchorMailbox / AuthenticatedUser values reached from source IPs outside your normal client ranges.

Message tracking — weaponized email

• Run Get-MessageTrackingLog for inbound mail with HTML bodies to user mailboxes; pivot on senders that precede anomalous OWA activity by minutes.
• Have the mail gateway re-scan recent inbound HTML mail for embedded <script> / event-handler attributes targeting OWA rendering.

Exchange / file system

• Compare current file set under Exchange web virtual directories against a known-good baseline (file integrity) to surface any added/modified .aspx, .asax, or .ashx.
• Review IIS app-pool worker recycling and unexpected child processes via Sysmon Event ID 1 where ParentImage is w3wp.exe.
• Confirm EEMS mitigation state and that the June 2026 SU is installed (build number check) on every server.

Deploy IOAs to a dedicated Exchange host group so prevention scope stays tight. Run in Detect for one baselining cycle, fold benign parents/children into the exclusion list, then escalate to Prevent.

No atomic IOCs published as of 2026-06-20 — the CSV uses REPLACE_WITH_… placeholders. Ship the behavioral signatures and the patch/EEMS audit block; fill atomic values only from your own confirmed triage.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_C2_IP,detect,high,2026-12-20,CVE-2026-42897 Exchange OWA C2,campaign:Exchange-OWA-CVE-2026-42897
sha256,REPLACE_WITH_WEBSHELL_SHA256,detect,critical,2026-12-20,CVE-2026-42897 web shell,campaign:Exchange-OWA-CVE-2026-42897
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-20,CVE-2026-42897 OWA C2,campaign:Exchange-OWA-CVE-2026-42897

w3wp.exe (MSExchange app pool) -> cmd|powershell|pwsh|cscript|wscript|mshta|certutil
new .aspx|.ashx|.asax under \FrontEnd\HttpProxy\ | \owa\auth\ | \aspnet_client\
OWA mailbox access from rare/new source IP shortly after inbound HTML email
outbound from Exchange host process to rare external IP (non-RFC1918, low freq)
inbound email with embedded <script>/event-handler rendered in OWA

%ExchangeInstallPath%\FrontEnd\HttpProxy\owa\auth\
%ExchangeInstallPath%\FrontEnd\HttpProxy\ClientAccess\
C:\inetpub\wwwroot\aspnet_client\
%ExchangeInstallPath%\Logging\HttpProxy\Owa\   (review for anomalous endpoints)
No named malware family or atomic IOC published as of 2026-06-20

# Confirm June 2026 SU installed (run on each Exchange server)
Get-Command ExSetup.exe | ForEach { $_.FileVersionInfo.ProductVersion }
# Confirm Exchange Emergency Mitigation Service (EEMS) running + mitigations applied
Get-Service MSExchangeMitigation | Select Status
Get-ExchangeServer | Get-ServerComponentState
Get-Mailbox -ResultSize 5   # sanity: management shell reachable
# Affected on-prem: Exchange SE, 2019 (CU14/CU15), 2016 (CU23). Exchange Online NOT affected.

1 · Verify patch + EEMS state across all Exchange servers

# Run from Exchange Management Shell on each server
$ver = (Get-Command ExSetup.exe).FileVersionInfo.ProductVersion
Write-Host "Exchange build: $ver"
Get-Service MSExchangeMitigation | Format-Table Name,Status
Get-ServerComponentState (hostname) | Where {$_.State -ne 'Active'}
# Cross-check build against the June 2026 SU build number for your CU.

2 · Baseline + hunt anomalous .aspx under Exchange web dirs (PowerShell)

$roots = @(
  (Join-Path $env:ExchangeInstallPath 'FrontEnd\HttpProxy'),
  'C:\inetpub\wwwroot\aspnet_client'
)
Get-ChildItem $roots -Recurse -Include *.aspx,*.ashx,*.asax,*.asmx -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
  Select-Object FullName, LastWriteTime, Length |
  Sort-Object LastWriteTime -Descending |
  Format-Table -AutoSize
# Compare every result against a known-good Exchange file baseline. Investigate unknowns.

3 · Surface w3wp.exe child processes (Sysmon, last 7d)

# Requires Sysmon Event ID 1 (process create)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-7)} |
  Where-Object { $_.Message -match 'ParentImage:.*\\w3wp\.exe' -and
                 $_.Message -match 'Image:.*\\(cmd|powershell|pwsh|cscript|wscript|mshta|certutil)\.exe' } |
  ForEach-Object { $_.TimeCreated; $_.Message } 

Coverage gaps: The email-delivery (T1566) and in-browser JavaScript execution (T1059.007) steps are inherently weak on EDR — the script runs in the browser, not as a host process. Close these with mail-gateway script stripping, message-tracking correlation (§7), and forwarded OWA logs feeding Q5. The post-exploit host-side pivot (web shell, w3wp children, egress) is well covered by Q1/Q2/Q4/Q6 + IOAs. Validation: all gates in §11 must pass before promoting any IOA to Prevent.