Microsoft Exchange Zero-Day Hack Confirmed—3 Vulnerabilities Exploited

InnovationCybersecurityMicrosoft Exchange Zero-Day Hack Confirmed—3 Vulnerabilities ExploitedByDavey Winder,Senior Contributor.Forbes contributors publish independent expert analyses and insights. Davey Winder is a veteran cybersecurity writer, hacker and analyst.Follow AuthorMay 16, 2026, 07:32am EDT--:-- / --:--This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.Microsoft Exchange zero-day exploit confirmed at Pwn2Own Berlin.gettyHot on the heels of three new zero-day exploits against Windows 11, confirmed on May 14, Microsoft was hacked again just 24 hours later, as a three-vulnerability chained Exchange zero-day exploit was demonstrated at the Pwn2Own elite hacking event in Berlin. Here’s what you need to know.ForbesMicrosoft Windows 11 Exploited 3 Times In 24 Hours By Zero-Day HackersBy Davey WinderMicrosoft Exchange Falls To Zero-Day Hack At Pwn2Own BerlinPwn2Own is a twice-yearly event organized by the Trend Micro Zero Day Initiative, where some of the world’s most elite ethical hackers compete against each other, and the clock, to exploit previously unknown vulnerabilities in both software and hardware. The Berlin event got off to a flying start on May 14 as Windows 11 was hit by no less than three zero-day exploits. On day two, hacking teams were no less successful, chaining together three new vulnerabilities in Microsoft Exchange in order to achieve the holy grail of SYSTEM-level remote code execution. Such was the level of this achievement that Orange Tsai from the DEVCORE Research Team was rewarded with a $200,000 bounty payment in return for immediately handing over all the technical details to the event organizers.This is why events such as Pwn2own, along with vendor bug bounty schemes, are so important in the overall scheme of security things. Whereas some security researchers sell their zero-days to the highest bidder on the black and grey vulnerability markets, and others disclose them to the pub...