https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 04 Sep 2026 16:55:36 +0000 https://vulnerability.circl.lu/sighting/4004b08a-8627-441c-bff1-b2abc5d55bc6/export {"uuid": "4004b08a-8627-441c-bff1-b2abc5d55bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mupf5zdupi2r", "content": "\ud83d\udce2 CVE-2026-42897 : TA488 exploite une XSS stock\u00e9e dans Exchange OWA via l'implant OWAReaper\n\nCet article constitue une analyse technique approfondie de la vuln\u00e9rabilit\u00e9 CVE-2026-42897 et de la campagne d'exploitation associ\u00e9e\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#ExchangeOWA #OWAReaper #Cyberveille", "creation_timestamp": "2026-09-04T16:30:18.956639Z"} {"uuid": "4004b08a-8627-441c-bff1-b2abc5d55bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mupf5zdupi2r", "content": "\ud83d\udce2 CVE-2026-42897 : TA488 exploite une XSS stock\u00e9e dans Exchange OWA via l'implant OWAReaper\n\nCet article constitue une analyse technique approfondie de la vuln\u00e9rabilit\u00e9 CVE-2026-42897 et de la campagne d'exploitation associ\u00e9e\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#ExchangeOWA #OWAReaper #Cyberveille", "creation_timestamp": "2026-09-04T16:30:18.956639Z"} https://vulnerability.circl.lu/sighting/4004b08a-8627-441c-bff1-b2abc5d55bc6/export Fri, 04 Sep 2026 16:30:18 +0000 https://vulnerability.circl.lu/sighting/75de487c-b27b-4c2d-8eea-56cf280c2a32/export {"uuid": "75de487c-b27b-4c2d-8eea-56cf280c2a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-04T00:00:50.220865Z"} {"uuid": "75de487c-b27b-4c2d-8eea-56cf280c2a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-04T00:00:50.220865Z"} https://vulnerability.circl.lu/sighting/75de487c-b27b-4c2d-8eea-56cf280c2a32/export Fri, 04 Sep 2026 00:00:50 +0000 https://vulnerability.circl.lu/sighting/254911e2-3843-4358-aee1-e7c2a27f9678/export {"uuid": "254911e2-3843-4358-aee1-e7c2a27f9678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-03T12:00:06.007278Z"} {"uuid": "254911e2-3843-4358-aee1-e7c2a27f9678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/bizone_channel/2707", "content": "\ud83d\udd3a \u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c JavaScript \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0438\u0441\u044c\u043c\u0430 \u0432 Outlook Web Access\n\n\u041e\u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 cross-site scripting: \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0438\u0441\u044c\u043c\u043e \u0447\u0435\u0440\u0435\u0437 Outlook Web Access, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 CVE-2026-42897 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 8,1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS.\n\n\u27a1\ufe0f\u041a\u0430\u043a\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exchange \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0438 \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\ud83d\udcac \u041c\u044b \u0432 MAX\n\ud83d\udc99 \u041c\u044b \u0432\u043e \u00ab\u0412\u041a\u043e\u043d\u0442\u0430\u043a\u0442\u0435\u00bb", "creation_timestamp": "2026-09-03T12:00:06.007278Z"} https://vulnerability.circl.lu/sighting/254911e2-3843-4358-aee1-e7c2a27f9678/export Thu, 03 Sep 2026 12:00:06 +0000 https://vulnerability.circl.lu/sighting/e69669ea-f3a5-4857-b93f-0e8e613dde81/export {"uuid": "e69669ea-f3a5-4857-b93f-0e8e613dde81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-31T00:00:37.648572Z"} {"uuid": "e69669ea-f3a5-4857-b93f-0e8e613dde81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-31T00:00:37.648572Z"} https://vulnerability.circl.lu/sighting/e69669ea-f3a5-4857-b93f-0e8e613dde81/export Mon, 31 Aug 2026 00:00:37 +0000 https://vulnerability.circl.lu/sighting/8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b/export {"uuid": "8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-30T00:00:40.904991Z"} {"uuid": "8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-30T00:00:40.904991Z"} https://vulnerability.circl.lu/sighting/8e839c00-3fde-46ed-b3f3-cdf1c01c9b9b/export Sun, 30 Aug 2026 00:00:40 +0000 https://vulnerability.circl.lu/sighting/a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f/export {"uuid": "a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-30T00:00:37.431722Z"} {"uuid": "a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "exploited", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-30T00:00:37.431722Z"} https://vulnerability.circl.lu/sighting/a89989ee-5a59-4c7b-8ff8-e7d70eb35f9f/export Sun, 30 Aug 2026 00:00:37 +0000 https://vulnerability.circl.lu/sighting/9d892fa7-537d-4074-8050-0e748a3b9268/export {"uuid": "9d892fa7-537d-4074-8050-0e748a3b9268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-29T20:00:15.298084Z"} {"uuid": "9d892fa7-537d-4074-8050-0e748a3b9268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/1620", "content": "On-prem Microsoft Exchange Server CVE-2026-42897 is under active exploitation.\n\nThe CVSS 8.1 spoofing flaw stems from XSS and can allow arbitrary JavaScript execution when crafted emails are opened in Outlook Web Access under certain conditions.", "creation_timestamp": "2026-08-29T20:00:15.298084Z"} https://vulnerability.circl.lu/sighting/9d892fa7-537d-4074-8050-0e748a3b9268/export Sat, 29 Aug 2026 20:00:15 +0000 https://vulnerability.circl.lu/sighting/b1de9d5c-1692-492b-95f0-766bca74ef9c/export {"uuid": "b1de9d5c-1692-492b-95f0-766bca74ef9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-29T20:00:06.877982Z"} {"uuid": "b1de9d5c-1692-492b-95f0-766bca74ef9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://t.me/CyberDispatch/2421", "content": "The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.\n\nEmail security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.\n\nLaundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.", "creation_timestamp": "2026-08-29T20:00:06.877982Z"} https://vulnerability.circl.lu/sighting/b1de9d5c-1692-492b-95f0-766bca74ef9c/export Sat, 29 Aug 2026 20:00:06 +0000 https://vulnerability.circl.lu/sighting/1a31802d-fe16-47a4-85df-84d2ec9cefa5/export {"uuid": "1a31802d-fe16-47a4-85df-84d2ec9cefa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "MISP/2a089124-5a80-4623-85c0-a9f18ed6a090", "content": "", "creation_timestamp": "2026-08-29T00:15:02.635975Z"} {"uuid": "1a31802d-fe16-47a4-85df-84d2ec9cefa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "MISP/2a089124-5a80-4623-85c0-a9f18ed6a090", "content": "", "creation_timestamp": "2026-08-29T00:15:02.635975Z"} https://vulnerability.circl.lu/sighting/1a31802d-fe16-47a4-85df-84d2ec9cefa5/export Sat, 29 Aug 2026 00:15:02 +0000 https://vulnerability.circl.lu/sighting/44ef3245-9586-4a19-ba43-911625486b02/export {"uuid": "44ef3245-9586-4a19-ba43-911625486b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mu65ao2mr22i", "content": "\ud83d\udee1\ufe0f CVE-2026-42897: CISA advierte hackeo masivo activo en Microsoft Exchange Server (OWA) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/05/cve-...", "creation_timestamp": "2026-08-28T19:53:12.537743Z"} {"uuid": "44ef3245-9586-4a19-ba43-911625486b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42897", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mu65ao2mr22i", "content": "\ud83d\udee1\ufe0f CVE-2026-42897: CISA advierte hackeo masivo activo en Microsoft Exchange Server (OWA) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/05/cve-...", "creation_timestamp": "2026-08-28T19:53:12.537743Z"} https://vulnerability.circl.lu/sighting/44ef3245-9586-4a19-ba43-911625486b02/export Fri, 28 Aug 2026 19:53:12 +0000