CVE-2026-42897

Stolen-trust response for OWAReaper access

→On-prem Exchange and Microsoft 365 identity teams should treat OWAReaper-related access as a stolen-trust incident, not just a password-reset event: patch or mitigate affected Exchange exposure, restrict OWA, revoke sessions and refresh tokens, audit EWS and Outlook add-in tokens, remove suspicious OAuth grants and mailbox permissions, clear OWA browser storage, inspect mailbox rules and forwarding, and scope mailbox-only versus tenant compromise from observed post-access activity.

When OWAReaper-related access is suspected, treat the case as stolen trust: patch or mitigate Exchange exposure, restrict OWA, revoke active sessions and refresh tokens, audit mailbox and add-in access, remove suspicious grants or permissions, clear browser-stored trust artifacts, and inspect mailbox rules and forwarding. Broader tenant compromise should be stated only when post-access evidence supports it.