ZDI-26-535: (Pwn2Own) Microsoft Exchange External Control of File Path Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-62911.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because remote attackers can execute arbitrary code on affected Microsoft Exchange installations (ZDI-26-535), restrict network access to Microsoft Exchange so it is not reachable from untrusted networks (e.g., block/expose only via approved ingress paths).
- Operational
Given the authentication mechanism can be bypassed to reach remote code execution (ZDI-26-535), rotate any exposed Exchange-related credentials and invalidate existing sessions after applying any available vendor remediation for CVE-2026-62911.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-535?
ZDI-26-535 has been assigned a CVSS rating of 7.2, indicating high severity.
How can I mitigate ZDI-26-535?
To mitigate ZDI-26-535, ensure that your Microsoft Exchange installations are updated with the latest security patches.
What type of vulnerability is ZDI-26-535?
ZDI-26-535 is a Remote Code Execution vulnerability that allows attackers to execute arbitrary code.
Who is affected by ZDI-26-535?
All installations of Microsoft Exchange that have not been patched against this vulnerability are at risk.
Is authentication required to exploit ZDI-26-535?
Yes, authentication is required; however, the existing authentication mechanism can be bypassed.