https://vulnerability.circl.lu/sightings/feed 2026-09-04T16:55:36.147209+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4004b08a-8627-441c-bff1-b2abc5d55bc6/export 2026-09-04T16:55:36.179161+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4004b08a-8627-441c-bff1-b2abc5d55bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mupf5zdupi2r", "content": "\ud83d\udce2 CVE-2026-42897 : TA488 exploite une XSS stock\u00e9e dans Exchange OWA via l'implant OWAReaper\n\nCet article constitue une analyse technique approfondie de la vuln\u00e9rabilit\u00e9 CVE-2026-42897 et de la campagne d'exploitation associ\u00e9e\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#ExchangeOWA #OWAReaper #Cyberveille", "creation_timestamp": "2026-09-04T16:30:18.956639Z"} 2026-09-04T16:30:18.956639+00:00 https://vulnerability.circl.lu/sighting/75de487c-b27b-4c2d-8eea-56cf280c2a32/export 2026-09-04T16:55:36.181829+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "75de487c-b27b-4c2d-8eea-56cf280c2a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-04T00:00:50.220865Z"} 2026-09-04T00:00:50.220865+00:00 https://vulnerability.circl.lu/sighting/254911e2-3843-4358-aee1-e7c2a27f9678/export 2026-09-04T16:55:36.182199+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "254911e2-3843-4358-aee1-e7c2a27f9678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-03T12:00:06.007278Z"} 2026-09-03T12:00:06.007278+00:00 https://vulnerability.circl.lu/sighting/e69669ea-f3a5-4857-b93f-0e8e613dde81/export 2026-09-04T16:55:36.182507+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e69669ea-f3a5-4857-b93f-0e8e613dde81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-31T00:00:37.648572Z"} 2026-08-31T00:00:37.648572+00:00 https://vulnerability.circl.lu/sighting/8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b/export 2026-09-04T16:55:36.182753+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-30T00:00:40.904991Z"} 2026-08-30T00:00:40.904991+00:00 https://vulnerability.circl.lu/sighting/a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f/export 2026-09-04T16:55:36.182864+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-30T00:00:37.431722Z"} 2026-08-30T00:00:37.431722+00:00 https://vulnerability.circl.lu/sighting/9d892fa7-537d-4074-8050-0e748a3b9268/export 2026-09-04T16:55:36.182929+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9d892fa7-537d-4074-8050-0e748a3b9268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-29T20:00:15.298084Z"} 2026-08-29T20:00:15.298084+00:00 https://vulnerability.circl.lu/sighting/b1de9d5c-1692-492b-95f0-766bca74ef9c/export 2026-09-04T16:55:36.182999+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b1de9d5c-1692-492b-95f0-766bca74ef9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-29T20:00:06.877982Z"} 2026-08-29T20:00:06.877982+00:00 https://vulnerability.circl.lu/sighting/1a31802d-fe16-47a4-85df-84d2ec9cefa5/export 2026-09-04T16:55:36.183074+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1a31802d-fe16-47a4-85df-84d2ec9cefa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "MISP/2a089124-5a80-4623-85c0-a9f18ed6a090", "content": "", "creation_timestamp": "2026-08-29T00:15:02.635975Z"} 2026-08-29T00:15:02.635975+00:00 https://vulnerability.circl.lu/sighting/44ef3245-9586-4a19-ba43-911625486b02/export 2026-09-04T16:55:36.183133+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "44ef3245-9586-4a19-ba43-911625486b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mu65ao2mr22i", "content": "\ud83d\udee1\ufe0f CVE-2026-42897: CISA advierte hackeo masivo activo en Microsoft Exchange Server (OWA) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/05/cve-...", "creation_timestamp": "2026-08-28T19:53:12.537743Z"} 2026-08-28T19:53:12.537743+00:00