What's happening in email security: May 11 – May 17, 2026

Crafted email triggers JavaScript in Outlook Web Access

CVE-2026-42897 is a cross-site scripting flaw in on-premises Exchange Server's OWA HTML rendering pipeline. The attacker sends a message whose HTML body slips JavaScript past OWA's sanitizer. When the recipient opens the message in their browser, the payload executes inside the OWA origin and inherits the user's authenticated session. From there it can read mail, send on the user's behalf, exfiltrate the session cookie, or call any OWA API against mailbox content the user can see. No attachment to click, no link to follow, just opening the message.

Microsoft hasn't published the sanitizer bypass technique or named the actors exploiting it. The fact that the official fix is a URL rewrite rule strongly suggests the payload sits in a URL-bearing attribute (an href or src that OWA renders without scrubbing) rather than in a script tag or event handler.

CISA added the CVE to the KEV catalog on May 15 and gave federal civilian agencies until May 29 to mitigate.

Exchange Server 2016, 2019, and Subscription Edition are all affected at every update level (CVSS 8.1). Exchange Online isn't affected. There's no patch yet, and Microsoft says updates are coming "in the future" for select cumulative updates only. ESU Period 1 customers won't get one at all.

The current mitigation is Microsoft's Emergency Mitigation Service, which applies a URL rewrite rule to neutralize the payload. It works, but it breaks calendar printing, blocks inline images in some messages, and disables OWA Light completely. Security teams are triaging which side effect their users will tolerate.

Several researchers are openly calling this Microsoft's strongest nudge yet toward the cloud, since Exchange Online customers are unaffected and on-prem patches look like they'll arrive slowly and selectively.

Exim ships emergency fix for CVSS 9.8 BDAT vulnerability

Exim 4.99.3 fixes CVE-2026-45185, a use-after-free in BDAT message body parsing. The exploit sends a TLS close notification followed by cleartext bytes during a CHUNKING SMTP session, which lets an attacker run code on the mail server. The researcher who found it, Federico Kirschbaum at XBOW Security Lab, said "almost no special configuration" is needed to trigger the bug.

Only GnuTLS-based Exim builds are affected. OpenSSL builds aren't. Versions 4.97 through 4.99.2 are vulnerable. If your distro packages Exim with GnuTLS (some Debian and Red Hat derivatives do), patch now. Exim runs a significant share of the world's MTAs, so check every mail relay you operate.

Ghostwriter uses geofenced PDFs to deliver Cobalt Strike to Ukrainian government

The Belarus-aligned group Ghostwriter (UNC1151, FrostyNeighbor, Storm-0257) has been running spear-phishing against Ukrainian military and government targets since March. The lure is a PDF impersonating Ukrtelecom. Victims who clicked received a RAR archive that dropped a JavaScript loader called PicassoLoader, which fetched Cobalt Strike Beacon.

The evasion layer is the interesting part. The PDFs were geofenced, so victims outside Ukrainian IP ranges received a benign document. After the loader ran, the system fingerprinted itself every 10 minutes and waited for an operator to manually approve final-stage payload delivery. ESET confirmed the campaign in parallel. Poland and Lithuania were also in scope.