Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897)

The feed reports active exploitation of two vulnerabilities: CVE-2026-42897, a Microsoft Exchange cross-site scripting flaw triggered when a malicious email is opened and attributed to the Russia-affiliated Laundry Bear/Void Blizzard group, and CVE-2026-20316, a Cisco Secure Firewall Management Center static-credentials flaw being exploited by attackers and flagged by CISA. It also covers phishing abusing Microsoft’s legitimate authentication workflow, a coordinated cyberattack against more than 30 Minnesota water utilities, updated CISA SBOM guidance, AI security tooling, and rising AI-driven