ZDI-26-535: (Pwn2Own) Microsoft Exchange External Control of File Path Remote Code Execution Vulnerability

Microsoft Exchange Server contains an authentication bypass flaw (CWE-294) in which captured authentication material can be replayed, allowing an authorized attacker to elevate privileges over a network. Per the CVSS vector, the attack is network-based with low complexity but requires the attacker to already hold low privileges and some user interaction, and success yields high impact on confidentiality, integrity, and availability. Affected products include on-premises Exchange Server and Exchange Server Subscription Edition, though specific vulnerable version ranges are not specified in the available data. Public scans indicate nearly 22,000 Exchange servers remain exposed to the flaw following the August 2026 Patch Tuesday fixes. No in-the-wild exploitation, public proof-of-concept, or KEV listing is known; the bug was demonstrated at Pwn2Own (ZDI-26-534) and carries an EPSS estimate of 1.3% probability of exploitation within 30 days.

Do: Apply the Exchange Server security updates released in Microsoft's August 2026 Patch Tuesday (refer to Microsoft's advisory for the exact fixed builds) on all on-premises servers, prioritizing internet-facing systems running OWA, EWS, or ActiveSync. Until patched, limit network exposure of Exchange endpoints to trusted networks and monitor authentication logs for replay-style anomalies; per the scan data, roughly 22,000 servers still need the update.