Improper Input Validation in Microsoft Exchange InterceptorSmtpAgent (CVE‑2026‑21527) Allows Unauthenticated Security Feature Bypass

Improper Input Validation in Microsoft Exchange InterceptorSmtpAgent (CVE‑2026‑21527) Enables Unauthenticated Security Feature Bypass

What It Is – A flaw in the InterceptorSmtpAgent class of Microsoft Exchange allows remote attackers to craft malformed SMTP headers that bypass a built‑in security feature. No authentication is required to trigger the bypass.

Exploitability – CVSS 5.3 (AV:N/AC:L/PR:N/UI:N). The vulnerability is publicly disclosed; no active exploit‑as‑a‑service reports are known, but the low‑complexity, network‑only attack vector makes exploitation feasible.

Affected Products – Microsoft Exchange (all supported on‑premises versions; Exchange Online inherits the same component).

TPRM Impact – Organizations that rely on Exchange for internal and external communications face a supply‑chain risk: attackers can sidestep email‑security controls, increasing the likelihood of phishing, malware propagation, and data leakage that may affect downstream partners.

Recommended Actions –

1. Deploy Microsoft’s security update for CVE‑2026‑21527 immediately.
2. Verify patch deployment across all Exchange servers (including hybrid and cloud‑managed instances).
3. Harden SMTP inspection: enable additional header validation, enforce TLS‑only delivery, and monitor for anomalous header patterns.
4. Review third‑party integrations that ingest Exchange mail (e.g., archiving, DLP) for potential exposure.
5. Update third‑party risk registers to reflect the new vulnerability and reassess vendor risk scores.

Source: Zero Day Initiative Advisory – ZDI‑26‑194