Encoded file:// scheme smuggling in Exchange EWS/OWA requests (CVE-2026-45504)

Ethan Andrews@eandrews

•updated Jul 2, 2026•3•0•17

Detects Microsoft Exchange EWS/OWA HTTP requests containing URL-encoded file scheme indicators (e.g., 'file%3a', '%66%69%6c%65'). This activity is associated with attempts to bypass security filters via scheme smuggling, potentially to facilitate Server-Side Request Forgery (SSRF) exploitation leading to unauthorized local file access.