A newly released proof-of-concept (PoC) exploit targeting CVE-2026-62911 has emerged, affecting Microsoft Exchange Server. This vulnerability is linked to an authentication bypass that could potentially lead to remote code execution without requiring prior authentication.
Understanding the Vulnerability
Although Microsoft categorizes this issue as an elevation-of-privilege vulnerability, research shows it can allow unauthenticated remote code execution in vulnerable Exchange environments. Researcher Nguyen Van Hiep published the PoC on GitHub, focusing on the Exchange Mailbox Replication Proxy service, known as MRSProxy.
The exploit documentation outlines that an HTTP.sys-hosted MRSProxy endpoint lacks Extended Protection for Authentication. This deficiency permits attackers to relay NTLM authentication from an Exchange machine account to the MRSProxy service, compromising the system.
Technical Details of the Exploit
Initially disclosed by Microsoft in August 2026, CVE-2026-62911 involves an authentication-bypass capture-replay weakness affecting on-premises Exchange servers. While Microsoft’s official description indicates that an authenticated attacker could elevate their privileges, the PoC reveals a more significant risk by demonstrating an NTLM relay pathway.
Exchange servers expose MRSProxy through multiple endpoints. Although the IIS-hosted /EWS/MRSProxy.svc path is protected, the MailboxReplicationService ProxyService endpoint may fail to validate channel bindings, enabling an NTLM relay attack.
Impact and Mitigation
In the attack scenario, an Exchange server is coerced to authenticate to an attacker-controlled listener using techniques like PetitPotam. The attacker then relays this authentication to another vulnerable Exchange server, gaining access to mailbox replication functions.
The PoC exploits WCF methods within the replication service, potentially allowing attackers to execute commands by placing a webshell in a web-accessible directory. Reports suggest this could lead to SYSTEM-level compromise.
The vulnerability comes from a three-bug chain demonstrated by DEVCORE’s Orange Tsai at Pwn2Own Berlin 2026, highlighting the severe security implications. Affected versions include Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM, with fixes available in Microsoft’s August 2026 security updates.
Future Outlook
As Exchange Server 2016 reached the end of support in October 2025, those lacking Extended Security Updates may face challenges in remediation. Administrators should ensure Extended Protection settings are verified, minimize exposure of Exchange services, monitor NTLM relay activity, and inspect unexpected ASPX files in directories.
This incident underscores the importance of timely security updates and proactive monitoring to prevent exploits. Organizations are advised to integrate threat intelligence into their security operations to strengthen defenses against such vulnerabilities.
