ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability
Pwn2Own-demoed CVE-2026-62911 capture-replay authentication bypass in Microsoft Exchange allows unauthenticated remote attacks, CVSS 8.1.
ZDI-26-534 describes a capture-replay authentication bypass vulnerability in Microsoft Exchange, demonstrated at Pwn2Own, allowing remote attackers to bypass authentication without credentials. ZDI assigned a CVSS score of 8.1, and the flaw is tracked as CVE-2026-62911. Exchange servers are widely deployed enterprise mail infrastructure.
- Capture-replay authentication bypass in Microsoft Exchange
- Demonstrated at Pwn2Own, no authentication required
- CVSS 8.1, tracked as CVE-2026-62911
- Exchange is broadly deployed enterprise infrastructure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC ×2 |
From the original article
This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.