CVE-2026-42897 OWA XSS Exploit Payload Achieves Mailbox Code Execution (TA488 OWAReaper)
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
Microsoft Sentinel (KQL)
