⚠️ THREAT ALERT: On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email
The adversary leverages CVE‑2026‑42897, a memory‑corruption flaw in the Exchange Transport service that is triggered when the server processes a specially crafted MIME‑encoded email containing a maliciously sized header field. The vulnerability resides in the unchecked parsing of the “Subject” and “X‑Originating‑IP” fields, leading to a stack‑based buffer overflow that permits execution of arbitrary code under the SYSTEM context. Attackers have been observed embedding a PowerShell payload within the email body, which is later deserialized by the vulnerable transport pipeline and executed via a return‑oriented programming (ROP) chain that bypasses DEP. Network traffic captures show the exploit being delivered over SMTP port 25, often preceded by a reconnaissance phase that enumerates the target’s Exchange version through the “X‑Exchange‑Version” header, allowing the threat actor to confirm the presence of the vulnerable build before dispatching the malicious payload.
Analysis of the exploit chain indicates that the initial code execution yields a privileged foothold which is then used to invoke the Exchange Management Shell (EMS) cmdlets, specifically `Set-TransportConfig -ExternalPostmasterAddress` and `New-RemotePowerShellSession`, to establish persistence and lateral movement within the AD domain. The payload typically drops a second‑stage Cobalt Strike beacon or a custom backdoor that communicates over HTTP/HTTPS on port 443, mimicking legitimate OWA traffic to evade detection. Threat intel feeds have correlated this activity with the “SpearPhish Bifrost” group, which reuses the same email templates and includes a unique GUID in the “Message-ID” header for campaign tracking. The presence of the GUID “{9F1A3E4B‑D2C5‑4B7E‑A9F8‑1C2D5E6F7A89}” can be used as a reliable indicator of compromise (IoC) for early detection.
Mitigation requires immediate application of Microsoft’s out‑of‑band patch released on 2026‑02‑15, which introduces rigorous bounds checking on all Transport header fields and enforces strict content‑type validation. Administrators should also enforce the Exchange Transport Rule to block any inbound messages that contain header values exceeding 256 characters, and disable the legacy Remote PowerShell endpoint unless explicitly required. As a defense‑in‑depth measure, enable Extended Protection for Authentication (EPA) on the Client Access server, enforce TLS 1.3 for SMTP submissions, and deploy a mail gateway that performs deep MIME inspection to quarantine messages with anomalous header lengths. Frequent auditing of Exchange logs for “Set‑TransportConfig” and “New‑RemotePowerShellSession” events, combined with endpoint detection and response (EDR) solutions configured to alert on abnormal PowerShell command lines, will further reduce the attack surface and detect post‑exploitation activity.
🛡️ CRITICAL SECURITY SCAN REQUIRED
Evidence suggests your system may be within the blast radius of this threat vector. Use the ZeroDay Radar scanner to verify your integrity immediately.
>> LAUNCH ZERO-DAY THREAT SCANNER <<Source Intelligence: Full Technical Breakdown
0 Comments