TA488 May Have Exploited Outlook Web Access 0-Day Flaw Before Microsoft’s Emergency Patch

Cybersecuritynews •Tushar Subhra Dutta • July 30, 2026

TA488 has been linked to a new campaign that turns a routine Outlook Web Access email into a gateway for mailbox compromise. The operation abused a now-patched cross-site scripting flaw, tracked as CVE-2026-42897, and could run malicious code when a recipient opened a message in the webmail interface. The campaign targeted government bodies and organizations […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TA488 Exploits Outlook Web Access CVE-2026-42897 in New Campaign TA488 has launched a campaign exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access (OWA). This vulnerability, disclosed by Microsoft on May 14, 2026, allows attackers to deploy a persistent JavaScript backdoor known as OWAReaper. The backdoor can survive credential rotations, browser restarts, and even full host re-imaging. Targeted entities include government bodies and organizations, indicating a significant scope of impact. The operation was confirmed to have exploited the flaw before Microsoft issued an emergency patch. The ongoing campaign raises concerns about the security of OWA users. As of July 30, 2026, the threat remains active. 3 sources 72

Extracted Entities

TA488 May Have Exploited Outlook Web Access 0-Day Flaw Before Microsoft’s Emergency Patch

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)