hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest

CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox. Aliteq Priya Nair · Software & Systems Editor

CVE-2026-62911: authentication bypass by capture-replay leading to elevation of privilege, CVSS 8.0.

Demonstrated with working exploit code at Pwn2Own Berlin; the code was handed directly to Microsoft.

Successful exploitation lets an attacker read, send, and download attachments across every mailbox on the server — not one account.

Patched August 11, 2026 for Exchange Server 2019 CU14 (KB5121575), CU15 (KB5121574), Exchange Server Subscription Edition RTM (KB5121573), and Exchange Server 2016 CU23 (KB5121576).

Exchange 2016 and 2019 are both past mainstream end of support — only customers enrolled in Extended Security Updates get this patch, through the end of October 2026.

Treat CVE-2026-62911 as same-day, not same-sprint. A public proof-of-concept from Pwn2Own combined with mailbox-wide exposure outranks its 8.0 score on paper.

Read the full story

Aliteq hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest Read the full story on Aliteq