Microsoft Exchange Server is facing multiple zero-day exploits, with one vulnerability (CVE-2026-42897) confirmed by CISA and actively exploited. This spoofing vulnerability allows attackers to execute JavaScript by sending a crafted email, potentially leading to remote code execution. A separate, more severe exploit demonstrated at Pwn2Own Berlin chained three vulnerabilities to achieve SYSTEM-level remote code execution, earning a $200,000 bounty for responsible disclosure. AI
Summary written by gemini-2.5-flash-lite from 2 sources. How we write summaries →
IMPACT N/A
RANK_REASON Demonstration of multiple zero-day exploits against Microsoft Exchange Server at the Pwn2Own Berlin hacking event. [lever_c_demoted from research: ic=2 ai=0.1]
