On the stage Pwn2Own one successful launch turned the corporate mail server into a machine under the full control of the attacker. Orange Tsai of DEVCORE at Pwn2Own Berlin 2026 linked three errors to Microsoft Exchange and achieved remote code execution with SYSTEM rights. Zero Day Initiative confirmed the victory and the maximum payment of $200 000.
For the attack, Tsai used not one critical hole, but a chain of three weak points. The first allowed you to bypass authentication through replaying data, the second violated the verification of authority, and the third allowed you to manage the file and eventually run arbitrary code on behalf of SYSTEM. This level of rights actually means full control of the Exchange server.
After coordinating the disclosure, Microsoft combined the chain under the CVE-2026-62911 ID with a score of 8.0 on CVSS 3.1. ZDI issued three separate notifications and estimated the chain links at 8.1, 7.2 and 8.8 points. The fix is included in the August Exchange Server updates.
The vulnerability affected Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. In August, a public PoC appeared, which reproduced the path from bypassing authentication to executing code. By the beginning of September, almost 22 thousand servers remained uncorrected, although there was no evidence of real attacks.
A separate interest was caused by the way the chain was searched. DEVCORE said that the work on Exchange took about a week, and the AI helped to understand the code and check the intermediate hypotheses. Tsai relied on many years of experience in analyzing Exchange, so the system acted as an accelerator, not an autonomous hacking author.
The victory in Exchange was the largest separate payment of the competition for Tsai, but not the only one. A day earlier, the specialist associated four logical errors in Microsoft Edge and came out of the browser sandbox, receiving another $ 175 000. According to the results of Pwn2Own Berlin, the DEVCORE team also hacked Windows 11 and SharePoint and received the title Master of Pwn.
Exchange's history shows the unpleasant side of modern attack chains. A separate error may look limited, but several defects connected in the correct order remove the protection of the layer by layer. In the case of CVE-2026-62911, the final was the SYSTEM session on the mail server, and Microsoft closed the way to it with the August update.
For the attack, Tsai used not one critical hole, but a chain of three weak points. The first allowed you to bypass authentication through replaying data, the second violated the verification of authority, and the third allowed you to manage the file and eventually run arbitrary code on behalf of SYSTEM. This level of rights actually means full control of the Exchange server.
After coordinating the disclosure, Microsoft combined the chain under the CVE-2026-62911 ID with a score of 8.0 on CVSS 3.1. ZDI issued three separate notifications and estimated the chain links at 8.1, 7.2 and 8.8 points. The fix is included in the August Exchange Server updates.
The vulnerability affected Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. In August, a public PoC appeared, which reproduced the path from bypassing authentication to executing code. By the beginning of September, almost 22 thousand servers remained uncorrected, although there was no evidence of real attacks.
A separate interest was caused by the way the chain was searched. DEVCORE said that the work on Exchange took about a week, and the AI helped to understand the code and check the intermediate hypotheses. Tsai relied on many years of experience in analyzing Exchange, so the system acted as an accelerator, not an autonomous hacking author.
The victory in Exchange was the largest separate payment of the competition for Tsai, but not the only one. A day earlier, the specialist associated four logical errors in Microsoft Edge and came out of the browser sandbox, receiving another $ 175 000. According to the results of Pwn2Own Berlin, the DEVCORE team also hacked Windows 11 and SharePoint and received the title Master of Pwn.
Exchange's history shows the unpleasant side of modern attack chains. A separate error may look limited, but several defects connected in the correct order remove the protection of the layer by layer. In the case of CVE-2026-62911, the final was the SYSTEM session on the mail server, and Microsoft closed the way to it with the August update.
