A security vulnerability in OWA allows JavaScript code execution by displaying emails. Russian actors are exploiting this.