Monthly Threat Report September 2026

Exploitation on a Shorter Clock

Written by Security Lab / 21.09.2026 / Threat Reports

Introduction

The Monthly Threat Report from Hornetsecurity by Proofpoint brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. This edition focuses on industry events from the month of August 2026. As a news and commentary edition, this month’s report prioritizes emerging threats and industry research over statistical sections.

Executive Summary

Proofpoint documented TA488, the Russia-aligned actor Microsoft calls Void Blizzard, exploiting the Outlook Web Access flaw from our July edition (CVE-2026-42897) to install a backdoor called OWAReaper. The implant makes the mailbox’s Default user an Owner of every mail folder, which no credential reset or device rebuild removes, and TA488’s infrastructure predates Microsoft’s May 14 advisory by two months.
A second on-premises Exchange flaw, CVE-2026-62911, fixed on August 11, now has public exploit code that needs no credentials, and roughly 21,900 servers remain unpatched. The Dutch and German national cyber agencies both say it works over the internet without a login, and a successful attacker controls every mailbox on the server.
Attacks on the SharePoint flaw CVE-2026-55040 jumped roughly a day after a published a proof-of-concept script went public on August 11. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on August 18, and by late August attackers were probing a chain pairing it with CVE-2026-63520 for remote code execution.
Microsoft detected more than a million fraudulent emails over three days in early August, each impersonating a named executive at the recipient’s own company. The messages asked accounts payable teams to pay a fabricated ServiceNow invoice, just under $50,000, by Automated Clearing House (ACH) transfer, with traces suggesting AI built the templates.
Our own August analysis argues that AI’s effect on attacks so far is mostly economic: existing categories get cheaper and faster to run at scale. The invoice campaign is that argument in practice.

Threat Overview

TA488 Brings the Half-Click Exploit to Outlook Web Access

Our July edition covered CVE-2026-42897, an actively exploited cross-site scripting (XSS) flaw in on-premises Exchange Server, and predicted Exchange would stay a priority target. Proofpoint published an analysis on July 29 showing what that looks like: TA488, a Russia-aligned espionage actor Microsoft tracks as Void Blizzard and others know as Laundry Bear, used the flaw to install a backdoor named OWAReaper, research also covered by Bleeping Computer and The Hacker News.

Proofpoint dates the campaign to July 22, one day before CISA, the FBI, and agencies from more than a dozen countries advised on the same actor’s exploitation of Zimbra Collaboration Suite through CVE-2025-66376, which Help Net Security also covered. TA488, unseen since February, opened its second webmail front the day before a coalition published on the first.

CVE-2026-42897 affects on-premises Exchange Server 2016, 2019, and Subscription Edition; Exchange Online is not affected. Microsoft scores it 8.1 (High) under the Common Vulnerability Scoring System (CVSS) v3.1, the National Vulnerability Database (NVD) rates it 6.1 (Medium), and the June 9 updates fix it. Microsoft has since revised that advisory to name the July updates as the fix for both this flaw and a closely related Outlook Web Access XSS bug, CVE-2026-55008 at 9.6 (Critical) and not yet marked as exploited.

Proofpoint calls this class “half-click”: conventional phishing needs the recipient to open an attachment or follow a link, while this needs them only to look. Exchange lets script-bearing HTML through in inbound mail bodies, and TA488 hides Base64 payload fragments behind the email’s social media icons, leaving a loader to reassemble and run them from an onload handler as the message renders.

What the loader delivers is built to stay: OWAReaper lives inside the Outlook Web Access page, writes nothing to disk, and uses Outlook’s own APIs to scrub the exploit from the server-side copy of the email. It then lays down three footholds: the Default user promoted to Owner on every mail folder through Exchange’s UpdateFolder operation, using OAuth tokens lifted from an add-in holding ReadWriteMailbox rights; an encrypted copy of the implant in browser localStorage; and cached IndexedDB messages rewritten to carry a hidden iframe. Targets included US and European government bodies plus telecommunications, finance, hospitality, and aerospace firms.

Why It Matters

A password reset, session revocation, and a device rebuild do not touch the Default user grant, because Exchange holds it on the server rather than on the endpoint or in the credential. Default applies to any signed-in user without a permission of their own, so Owner rights there open the mailbox to every account in the organization.

Cleanup is therefore separate work from patching: take the Default grant off, revoke tokens tied to affected add-ins, and clear the Outlook Web Access offline cache on any endpoint that opened a malicious message.

What AI Has and Has Not Changed About the Threat Landscape

In early August we published an analysis of how AI is accelerating cyber threats, whose central claim is deflationary: the categories of attack have not changed much, but the cost and speed of running them have. It shows in phishing without the language errors much user training was built on, in deepfakes reaching the channels people use to verify email, and in business email compromise personalized at volume. That last one stopped being theoretical during the month this edition covers. Volume and personalization used to trade off against each other, and defenders have spent years building intuitions on the assumption that they always would.

Major Incidents and Industry Events

A Second Exchange Flaw, a Public Exploit, and 21,899 Unpatched Servers

On-premises Exchange had a second bad month in a row. Microsoft’s August 11 updates fixed CVE-2026-62911, an authentication bypass by capture-replay that Microsoft rates Critical at CVSS 8.0. Orange Tsai of the DEVCORE Research Team reported it through the Zero Day Initiative after demonstrating it at Pwn2Own Berlin 2026 in a three-bug chain ending in SYSTEM code execution. Affected products are again Exchange Server 2016, 2019, and Subscription Edition, with Exchange Online out of scope, and because 2016 and 2019 are past end of support, the fix reaches them only through Microsoft’s paid Extended Security Updates (ESU) program.

Microsoft’s advisory spells out the payoff for attackers: control of every mailbox on the server, with the ability to read mail and attachments and send as those users. The exploit’s CVSS vector assumes a low-privileged account and some user interaction; the public exploit does not bear that out, and the Dutch and German national cyber agencies both call it usable from the internet by someone with no account at all.

On August 28, the Netherlands National Cyber Security Centre (NCSC-NL) warned that exploit code was now public and would take little skill to use. Days later Shadowserver, which began scanning for the flaw on August 27, counted 21,899 internet-reachable addresses still running an unpatched build, led by the United States at about 6,200 and Germany at about 5,100. Germany’s Federal Office for Information Security (BSI) put it more bluntly, with around 85% of German on-premises Exchange servers still open to the flaw.

Why It Matters

Three weeks separated the patch from that scan, the exploit went public inside that window, and the organizations in Shadowserver’s count are relying on attackers not having reached them yet. Pair that with the TA488 findings and the summer reads badly: two flaws in the same product, one exploited before its advisory existed, one with a public exploit and no credentials required. BSI suggests letting only trusted IP ranges or VPN connections reach Exchange web services, and NCSC-NL tells operators of Exchange 2016 and 2019 to take those servers off the internet and plan flat-out replacement.

SharePoint Attacks Surged a Day After the Proof of Concept

Microsoft fixed CVE-2026-55040 in its July updates, describing an authentication layer that can be stepped around over the network, which leaves an unauthenticated party connected anonymously, able to read files and alter what is stored. It rates the flaw Critical at CVSS 9.1, CISA catalogs it as a weak authentication vulnerability, and the affected products are SharePoint Server 2016, 2019, and Subscription Edition; SharePoint Online is not affected.

Exploitation stayed sparse until August 11, when Rapid7 published its analysis along with a proof-of-concept script. Rapid7 traced it to how two SharePoint classes validate JSON Web Tokens (JWTs) and found several defects that stack, among them a handler that accepts a token declaring alg: none, treats SharePoint’s own certificate thumbprint as proof of a token’s origin, and never verifies the signature cryptographically. Together they let an unauthenticated attacker mint a token good enough to act as any user of the site, administrators included.

The next day, the threat intelligence firm Defused posted that Rapid7’s script was already in traffic hitting its SharePoint honeypots, which both SecurityWeek and The Hacker News picked up: two-thirds of the dozen attempts KEVIntel had logged since July 19 fell on August 12 and 13. CISA added the flaw to the KEV catalog on August 18.

The bypass also turned out to be the front half of a longer chain. On August 11, Microsoft and Rapid7 disclosed CVE-2026-63520, a remote code execution flaw in SharePoint’s Business Connectivity Services rated Important at CVSS 8.1 and fixed in the August updates. By Rapid7’s account, putting CVE-2026-55040 in front of it lets an attacker with no credentials run arbitrary code as SharePoint’s service account. VulnCheck published a walkthrough on August 24, and a day later Defused saw the chain probed in its honeypots, with attackers clearing the bypass and cataloguing administrator accounts in bulk but no session reaching code execution.

Why It Matters

The interval that should worry defenders is between publication and a jump in attacks, about a day here, and the chain write-up repeated it. The longer-running slack that public proof-of-concept code used to come with is gone for internet-facing Microsoft server products, and attacker skill had little to do with it: a working script removed the only expensive (and difficult) part of the job. If your patch cycle takes weeks to validate a July update, an August proof of concept finds you still exposed, and you hear about it from a honeypot report, not your change calendar.

A Million Impersonation Emails in Three Days

Across three days in early August, Microsoft’s detections added up to more than a million fraudulent messages bound for corporate inboxes, sent through third-party email provider accounts, and Dark Reading also covered the campaign. The lure was standard invoice fraud; the highly specific targeting was the unusual part, since each message named real executives at the recipient’s own organization.

The operators put a target company’s CEO, CFO, or president into the sender and reply-to display names and the signature block, then addressed the message to its accounts payable staff. The invoice sat directly below that signature, rendered in the body rather than attached, billing an annual ServiceNow platform subscription, for example, at just under $50,000 and routing payment by ACH to attacker-controlled bank details. Underneath it ran two invented forward threads in which the spoofed executive and a spoofed ServiceNow president appear to agree to the purchase. Supporting infrastructure included the lookalike service-nowinc[.]com, registered on July 31, and the reply-to domain domainlify[.]net.

Microsoft’s stated indicators of AI assistance are things security teams can look for: HTML comments left in the source in quantity, explicit section labels, a sameness of construction across mail that ought to have varied more, dividers drawn as long runs of equals signs, and heavy em-dash punctuation. Microsoft stops short of the stronger claim, noting these suggest AI involvement without establishing how much content AI generated. Around 87.7% of the campaign targeted recipients in the United States, and Microsoft saw no sign of a breach at ServiceNow or the other companies named in the lures.

Why It Matters

This request was built to look like the legitimate ones around it. It arrived with the right names attached, cited a vendor a large enterprise plausibly pays, carried an amount too small to demand board attention and too large to wave through, and came with its own manufactured approval thread. No technical control was defeated: the campaign worked through a functioning mail system and asked a human to authorize a payment, which is that human’s job. The countermeasure is procedural, and an emailed payment instruction gets verified through a channel that is not email, every time.

Predictions for the Coming Months

The interval between a published proof of concept and in-the-wild exploitation will keep compressing, and patch cycles built around a longer one will keep being caught out. We expect more organizations compromised through vulnerabilities they had already approved a patch for but not yet deployed, with the post-incident finding landing on scheduling rather than detection.
Post-remediation persistence will become one of the defining incident response problems of late 2026. TA488’s foothold is a permission on the mail server, untouched by a password reset or a device rebuild. We expect server-side permission changes and OAuth token abuse in a growing share of incidents where the victim believed remediation was done.
Half-click and zero-click webmail exploitation will spread beyond the actors currently using it. Taking the recipient’s click out removes the least reliable step in email-borne intrusion, and TA488 has now used it against both Zimbra and Outlook Web Access. We expect other state-aligned groups, then financially motivated ones, to turn it against on-premises webmail that lags on patches.
Fraud that is both high-volume and individually tailored will become the ordinary case rather than the notable one. Awareness programs that still teach staff to look for language errors and generic greetings will lose ground, and the organizations that hold up will be those that made verification a process.

Monthly Recommendations

Patch internet-facing on-premises Microsoft servers on a compressed clock, and verify deployment rather than approval. Confirm the August Exchange updates and both the July and August SharePoint updates are installed on every host, not merely approved in your tooling. Exchange Server 2016 and 2019 get the August fix only through the paid ESU program, so take any server outside it off the internet until you can replace it.
Assume persistence and remediate beyond the password reset. Audit mailbox folder permissions and delegate access, with particular attention to Owner-level grants held by the Default user, review installed Outlook add-ins, and revoke sessions and OAuth refresh tokens explicitly. Organizations that applied the CVE-2026-42897 fix late should scope those investigations back to at least March 2026.
Require out-of-band verification for every payment instruction that arrives by email. Allow no exception for urgency, seniority, or a convincing approval thread, and rehearse it so finance staff are not improvising. Pair it with Security Awareness Training that reflects current lures, because advice to watch for clumsy writing no longer describes the mail users receive.
Keep an independent backup of Microsoft 365 data. Mailboxes, SharePoint sites, and OneDrive content sit in the blast radius of every attack in this edition, and recovery inside the same tenant is not independent of a tenant-level compromise. 365 Total Backup closes it.

About Hornetsecurity

Hornetsecurity is a leading global provider of next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world. Its flagship product, 365 Total Protection, is the most comprehensive cloud security solution for Microsoft 365 on the market. Driven by innovation and cybersecurity excellence, Hornetsecurity is building a safer digital future and sustainable security cultures with its award-winning portfolio. Hornetsecurity operates in more than 120 countries through its international distribution network of 12,000+ channel partners and MSPs. Its premium services are used by more than 125,000 customers.