ZDI-26-082: Microsoft Exchange InterceptorSmtpAgent Reliance on Untrusted Inputs Security Feature Bypass Vulnerability
This vulnerability allows remote attackers to bypass a security feature on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-21527.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-082?
The severity of ZDI-26-082 is high due to the ability of remote attackers to bypass security measures without authentication.
How do I fix ZDI-26-082?
To fix ZDI-26-082, ensure that you apply the latest security patches released by Microsoft for affected versions of Exchange.
Which Microsoft Exchange versions are affected by ZDI-26-082?
All supported versions of Microsoft Exchange are potentially affected by ZDI-26-082.
What type of attack can exploit ZDI-26-082?
ZDI-26-082 can be exploited through remote attacks that bypass security controls in the Exchange InterceptorSmtpAgent.
Is authentication required to exploit ZDI-26-082?
No, authentication is not required to exploit ZDI-26-082, making it particularly dangerous.