Body: CVE-2026-42897 Exchange OWA stored XSS

calendar Sep 9, 2026  ·
Share on: linkedin copy

Detects messages exploiting CVE-2026-42897, a stored XSS vulnerability in on-premises Exchange Outlook Web Access (OWA). The exploit embeds Base64-encoded JavaScript payload fragments after URL fragment identifiers (#) within data URI image src attributes, with a malformed img tag onload/onerror handler that reassembles and executes the fragments via eval(atob(...)). Detection covers both the delivery technique (img tags with event handlers combined with base64 data after # fragments) and implant content (OWAReaper-specific function names and API calls decoded from base64 within img tag src attributes). Simply opening the message in OWA's reading pane can trigger execution.

Sublime rule (View on GitHub)

 1name: "Body: CVE-2026-42897 Exchange OWA stored XSS"
 2description: "Detects messages exploiting CVE-2026-42897, a stored XSS vulnerability in on-premises Exchange Outlook Web Access (OWA). The exploit embeds Base64-encoded JavaScript payload fragments after URL fragment identifiers (#) within data URI image src attributes, with a malformed img tag onload/onerror handler that reassembles and executes the fragments via eval(atob(...)). Detection covers both the delivery technique (img tags with event handlers combined with base64 data after # fragments) and implant content (OWAReaper-specific function names and API calls decoded from base64 within img tag src attributes). Simply opening the message in OWA's reading pane can trigger execution."
 3type: "rule"
 4severity: "critical"
 5references:
 6  - "https://www.resecurity.com/blog/article/inside-owareaper-how-cve-2026-42897-enables-persistent-exchange-mailbox-compromise"
 7  - "https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit"
 8source: |
 9  type.inbound
10  and any(html.xpath(body.html, '//img[contains(@src,"data:image")]').nodes,
11          (
12            regex.icontains(.raw, '#[A-Za-z0-9+/=]{20,}')
13            and regex.icontains(.raw, 'on(?:load|error)')
14            and strings.icontains(.raw, 'eval(', 'atob(', 'Function(')
15          )
16          or (
17            any(strings.scan_base64(.raw),
18                strings.icontains(.,
19                                  'owaRequest',
20                                  'GetClientAccessToken',
21                                  'owa_offline_db',
22                                  'PageDataPayload',
23                                  'UpdateFolder'
24                )
25            )
26          )
27  )  
28attack_types:
29  - "Malware/Ransomware"
30tactics_and_techniques:
31  - "Evasion"
32  - "Exploit"
33  - "Scripting"
34detection_methods:
35  - "Content analysis"
36  - "HTML analysis"
37id: "e58b744f-fabe-530f-9e1a-3030d622dac7"
to-top