CVE-2026-62911: Exchange Authentication Bypass Enables Full…

Discovered at Pwn2Own by Orange Tsai, ZDI-26-534 hits on-premises Exchange with a CVSS 8.0 score. Microsoft released the patch after 82 days of coordinated disclosure.

Orange Tsai of the DEVCORE Research Team demonstrated a vulnerability at Pwn2Own that completely bypasses Microsoft Exchange authentication. Coordinated disclosure began on May 21, 2026; the patch arrived on August 11, 2026, after 82 days. The exposure window is closed, but the mechanism remains a wake-up call for anyone managing on-premises mail servers: under certain conditions, a remote attacker can seize all corporate mailboxes without valid credentials.

Key Takeaways

Vulnerability ZDI-26-534 (CVE-2026-62911) is a capture-replay authentication bypass with a CVSS 3.1 base score of 8.0, discovered by Orange Tsai at Pwn2Own and disclosed via ZDI-Microsoft coordinated disclosure.
The flaw resides in a weak alternative path in the Exchange authentication process: the attacker captures and replays tokens or credentials, evading identity checks.
Microsoft documents the impact as a complete takeover: reading, sending, and downloading attachments from all user mailboxes, classified as privilege elevation with critical severity.
Affected versions are Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM, with specific builds listed in the CVE record; Microsoft has released an official update.

The Capture-Replay Mechanism and Why Exchange Falls for It

The vulnerability is cataloged as CWE-294, Authentication Bypass by Capture-replay. The CVE-2026-62911 record states: "Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network." The word "authorized" in the CVE text warrants attention: it does not require administrative privileges, but assumes an attacker who has already obtained network access with basic credentials — or, in this specific case, who can capture and replay authentication tokens without decrypting them.

The ZDI-26-534 advisory adds the decisive technical detail: "The issue results from using an alternative, weak authentication path." When handling certain authentication requests, Microsoft Exchange activates a secondary path less robust than the primary one. The capture-replay attack finds room on this path: the intercepted token or credential is replicated by the attacker, who is recognized as legitimate by the server without the identity check detecting the replay.

The full CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. Network, Low attack complexity, Low privileges required, User interaction required. The triple High on Confidentiality, Integrity, and Availability confirms that a successful exploit completely compromises the security triad on Exchange resources. The E:U (Exploit code Unproven) and RL:O (Remediation Level: Official fix) indicators snapshot the situation at publication: no known public attack code, but a patch is available.

"The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments." — Microsoft MSRC Security Update Guide, CVE-2026-62911

Timeline and the Pwn2Own-to-Patch Pipeline

The coordinated publication date is August 11, 2026, but the path began three months earlier. The vendor notification — Microsoft — occurred on May 21, 2026, as documented in the ZDI advisory. The 82-day interval represents the real risk window in which Microsoft developed and tested the update while vulnerability details remained confidential among ZDI, the researcher, and the vendor.

This pipeline — hacking competition, research acquisition by ZDI (Trend Micro), coordinated vendor disclosure, patch, public release — has become standard industry infrastructure. Pwn2Own acts as sonar for high-impact flaws in mature enterprise products: Exchange, in this case, is a recurring target precisely because it continues to reveal attack surfaces not evident in normal development cycles. The "(Pwn2Own)" prefix in the ZDI-26-534 title is not decorative: it certifies the vulnerability was demonstrated working in a controlled environment, not merely theorized.

Orange Tsai's role is documented precisely in the advisory: "Orange Tsai (@orange_8361) from DEVCORE Research Team." Tsai is a researcher known for high-impact authentication flaws; his association with DEVCORE, not Trend Micro or ZDI, must be kept distinct: ZDI coordinated the disclosure, but the discovery occurred in an independent context.

Impact Scenarios: When a Mailbox Is No Longer Yours

Microsoft's exploitability assessment is clear: "Exploitation Less Likely," "Publicly disclosed No," "Exploited No." At the time of the update release, no public attack code existed and Microsoft had not detected in-the-wild exploitation. This classification, however, must be read in the context of a CVSS 8.0 and a mailbox takeover impact: it is not a guarantee of low risk, but a temporal snapshot.

The documented consequences are total in scope. The issue is not access to a single mailbox, but "take over the mailboxes of all Exchange users." In an organization with on-premises Exchange, this means: complete reading of every user's email; ability to send emails with spoofed internal identity; download of attachments potentially containing sensitive data, contracts, financial or personal information. Compromise of an Exchange server becomes, in effect, a total breach of corporate communication.

The UI:R (User Interaction Required) factor in the CVSS introduces uncertainty about the concrete vector. The dossier does not specify whether the required interaction is social — a user clicking a link — or technical — an automatic request that triggers the weak alternative path. This ambiguity has operational relevance: if the interaction is social, risk concentrates on targeting; if technical, the attack surface widens to specific configurations or automated flows.

What to Do Now

Microsoft has released an official update for affected versions. The priority is applying the patch to on-premises Exchange systems corresponding to the builds listed in the CVE-2026-62911 record: Exchange Server 2016 CU23, 2019 CU14/CU15, Subscription Edition RTM with the specific "affected from...before..." build ranges documented by the primary CVE source.

Verifying the current build against the CVE list is the first check. Affected versions have precise builds: the update must bring every instance to a build later than the "before" threshold indicated in the record.

Checking for mailbox access anomalies during the May 21 – August 11, 2026 window is a prudent verification. The dossier does not document in-the-wild exploitation, but the exposure window objectively exists; Exchange authentication logs must be examined for unusual access patterns or token replay.

Monitor for the emergence of public exploit code over the next 30–60 days. The E:U (Unproven) indicator in the CVSS and the MSRC "Exploitation Less Likely" assessment are valid at publication; a shift of E:U toward E:P (Proof-of-Concept) or E:F (Functional) would transform the risk profile, given the ease of network access (AV:N) and low privilege required (PR:L).

Why This Flaw Matters Beyond the Single Patch

The real signal of ZDI-26-534 is not the single closed vulnerability, but the confirmation that mature enterprise authentication systems — not startups, not niche products, but Exchange, a pillar of global corporate communication — continue to hide weak alternative paths. Capture-replay is not a new technique; that it can still bypass authentication of a three-decade-old product in 2026 indicates that accumulated complexity introduces flaws where the original architecture did not anticipate modern vectors.

The Pwn2Own competition confirms itself as a more accurate thermometer than traditional bug bounty programs: it rewards working demonstration, not theoretical reporting. The coordinated disclosure pipeline — 82 days in this case — remains the best compromise between responsibility to users and the necessity of patch development. The risk is that this window, for sophisticated actors with access to intelligence or their own exploits, may be sufficient.

For companies with cloud-on-premises hybridization, the lesson is twofold: migration to Exchange Online does not immunize against analogous flaws, but reduces the autonomous control surface; maintaining on-premises Exchange requires patching speed that many organizations do not systematically demonstrate. ZDI-26-534 is a patch; the underlying problem is the discrepancy between researcher discovery speed and IT operations response speed.

What is the difference between ZDI-26-534 and CVE-2026-62911?

ZDI-26-534 is the Zero Day Initiative advisory identifier, the organization that purchased and coordinated disclosure of the research. CVE-2026-62911 is the official CVE program record identifier, managed by MITRE, which catalogs the vulnerability with CVSS score and standard metadata. They are two labels for the same flaw, released by different authorities for different purposes: ZDI documents the discovery and disclosure timeline, CVE standardizes severity and impact classification.

Why is the CVSS 8.0 but Microsoft classifies it as Critical?

The CVSS 3.1 base score of 8.0 (HIGH) and Microsoft's "Critical" classification come from different scales. CVSS measures technical severity via a standardized formula; Microsoft MSRC applies its own severity assessment that integrates business impact, ease of use, and the context of its products. In this case, the discrepancy is minimal — 8.0 sits at the upper boundary of the HIGH band — and Microsoft's classification reflects the mailbox takeover, which in the enterprise threat model has critical relevance regardless of the numeric score.

Does "Exploitation Less Likely" mean I can wait to patch?

No. "Exploitation Less Likely" indicates that at the time of publication Microsoft had not detected public attack code or active exploitation. It is a temporal snapshot, not a prediction. The combination of CVSS 8.0, network access (AV:N), low privilege required (PR:L), and total impact on mailboxes makes this vulnerability an attractive target for exploit development. The assessment can change rapidly; the official patch (RL:O) is available and represents the only documented mitigation.

Information verified against cited sources and current as of publication.

Sources

Sources and references