ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Microsoft Exchange privilege-escalation flaw (CVE-2026-62911, CVSS 8.8) where the required authentication can be bypassed.
ZDI advisory ZDI-26-538 describes CVE-2026-62911, an improper authorization vulnerability in Microsoft Exchange rated CVSS 8.8. Remote attackers can escalate privileges, and while authentication is nominally required, the existing authentication mechanism can be bypassed. The vulnerability was demonstrated at Pwn2Own.
- CVE-2026-62911, CVSS 8.8 improper authorization privilege escalation in Microsoft Exchange
- Authentication requirement can be bypassed, enabling remote privilege escalation
- Demonstrated at Pwn2Own and published via ZDI advisory ZDI-26-538
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC ×2 |
From the original article
This vulnerability allows remote attackers to escalate privileges on affected installations of Microsoft Exchange. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.