Will a zero-day vulnerability in Microsoft Exchange be exploited in the wild before being patched in 2026?
[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-31 (today is 2026-11-07). The market requested evidence of a Microsoft Exchange zero-day exploited in the wild before or on the same day as Microsoft's official patch release, per Microsoft Security Response Center or CISA KEV by 2026-11-01. The recent intelligence provided covers 2026-11-06 CISA additions, but no CVE related to Microsoft Exchange appears. Only CVE-2026-19868 (SonicWall) was added to the KEV catalog in the provided update. No credible evidence of Exchange zero-day exploitation emerged during the resolution window.
Evidence: https://threatodds.com/markets/4e78e5ac-c1f1-4e7e-8407-3184b0101432Market Overview
Microsoft Exchange has been a perennial target — ProxyLogon (2021), ProxyShell (2021), and OWASSRF (2022) were all exploited before widespread patching. Nation-state actors, particularly Chinese APTs, maintain persistent interest in Exchange infrastructure. This market forecasts whether Exchange will see another zero-day exploitation event in 2026.
Resolution Criteria
Resolves YES if: A CVE in Microsoft Exchange Server or Exchange Online is confirmed exploited in the wild before or on the same day as Microsoft's official patch release, per Microsoft's own Security Response Center or CISA KEV before 2026-11-01.