Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
CVE-2026-42897: Exchange Server OWA Spoofing Flaw Exploited via Crafted Email
Excerpt
Microsoft has disclosed a vulnerability impacting on-premise versions of Exchange Server that is already seeing active exploitation in the wild. Tracked as CVE-2026-42897, the issue carries a CVSS score of 8.1 and affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition, while Exchange Online is not impacted. Microsoft describes it as a spoofing issue rooted in cross-site scripting that can be triggered when a user opens a specially crafted…
Read the original report →Attack Flow4 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-42897 | High | Score 69/100 | First seen |
IOC Relationship Graph
Building graph…