Max-severity Exchange server flaw under active exploitation by Kremlin hackers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear | 6.1 | 71% | KEV | KEV |
From the original article
1 min read at arstechnica.com
Russian state hackers are using a maximum-severity vulnerability in Microsoft Outlook’s Exchange Server to backdoor unpatched machines and steal credentials and other confidential information from them, security researchers said Thursday. The attacks are coming from TA488, a tracking name for a group working on behalf of the Kremlin, Proofpoint researchers said Thursday .
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.