Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
60
Hackers Actively Searching for Unpatched Microsoft Exchange Servers
60
60
35
Suspected Chinese Group Calypso APT Exploiting Vulnerable Microsoft Exchange Servers
60
62,000 Microsoft Exchange Servers potentially left unpatched
60
30
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
60
60
47
60
92% of worldwide Microsoft Exchange IPs are now patched or mitigated
60
60
60
35
55
60
ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Microsoft Exchange privilege-escalation flaw (CVE-2026-62911, CVSS 8.8) where the required authentication can be bypassed.
ZDI advisory ZDI-26-538 describes CVE-2026-62911, an improper authorization vulnerability in Microsoft Exchange rated CVSS 8.8. Remote attackers can escalate privileges, and while authentication is nominally required, the existing authentication mechanism can be bypassed. The vulnerability was demonstrated at Pwn2Own.
55
35
55
60
ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability
Pwn2Own-demoed CVE-2026-62911 capture-replay authentication bypass in Microsoft Exchange allows unauthenticated remote attacks, CVSS 8.1.
ZDI-26-534 describes a capture-replay authentication bypass vulnerability in Microsoft Exchange, demonstrated at Pwn2Own, allowing remote attackers to bypass authentication without credentials. ZDI assigned a CVSS score of 8.1, and the flaw is tracked as CVE-2026-62911. Exchange servers are widely deployed enterprise mail infrastructure.
55
60
60
55
60
60
Patch Tuesday for August 2022 fixed actively exploited zero
60
47
35
60
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
60
60
42
60
60
60
42