Critical Microsoft Exchange RCE Exploit Released: CVE-2026-62911 PoC Unleashes SYSTEM-Level Threat
A proof-of-concept (PoC) exploit for CVE-2026-62911, a severe Microsoft Exchange Server vulnerability, has been publicly released, enabling unauthenticated remote code execution (RCE) with SYSTEM-level privileges on unpatched systems. The flaw, disclosed by Microsoft in August 2026, stems from an authentication capture-and-replay weakness in the Exchange Mailbox Replication Proxy (MRSProxy) service, which fails to enforce Extended Protection for Authentication (EPA) on certain endpoints.
Attack Chain & Exploitation
The exploit, published on GitHub by researcher Nguyen Van Hiep, leverages an NTLM relay attack to bypass authentication. The attack unfolds in three key stages:
- Coercion & Capture – An attacker forces an Exchange server to authenticate to a malicious listener (e.g., via PetitPotam).
- Relay to Vulnerable Endpoint – The captured NTLM authentication from the Exchange machine account is relayed to an unprotected HTTP.sys-hosted MRSProxy endpoint, which lacks EPA validation.
- Arbitrary File Write & RCE – The attacker abuses Windows Communication Foundation (WCF) methods (
IMailbox_Config6,IMailbox_Connect) to write an ASPX webshell into a web-accessible directory, enabling command execution under the Exchange service context potentially achieving SYSTEM privileges.
Affected Systems & Patch Status
The vulnerability impacts:
- Exchange Server 2016 CU23 (unsupported since October 2025, no patches without Extended Security Updates)
- Exchange Server 2019 CU14 & CU15
- Exchange Server Subscription Edition RTM
Microsoft released fixes in August 2026 for supported versions:
- Exchange 2016 CU23 (15.1.2507.72)
- Exchange 2019 CU14 (15.2.1544.44)
- Exchange 2019 CU15 (15.2.1748.49)
- Exchange Server Subscription Edition (15.2.2562.46)
Origin & Security Impact
The flaw was part of a three-bug chain demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026, earning a $200,000 reward highlighting its criticality. While Microsoft initially classified it as an elevation-of-privilege (EoP) issue, the PoC reveals a far more dangerous pre-authentication RCE scenario, eliminating the need for prior credentials in certain configurations.
Mitigation & Detection
Organizations are advised to:
- Apply August 2026 security updates immediately.
- Verify Extended Protection settings on Exchange services.
- Restrict exposure of MRSProxy endpoints where unnecessary.
- Monitor for unusual NTLM relay activity and unexpected ASPX files in IIS/Exchange directories.
Unpatched systems remain at high risk of compromise, with the PoC now publicly available for exploitation.
Source: https://cybersecuritynews.com/poc-microsoft-exchange-server-pre-auth-rce/
Microsoft Security cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security
"id": "MIC1788265560",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'All unpatched Microsoft '
'Exchange Server deployments',
'industry': 'Technology, Enterprise IT',
'location': 'Global',
'name': 'Microsoft Exchange Server users',
'size': 'Large (enterprise-scale deployments)',
'type': 'Software/Service Provider'}],
'attack_vector': 'NTLM relay attack',
'customer_advisories': 'Apply security updates immediately, monitor for signs '
'of compromise, and enforce EPA on Exchange services.',
'data_breach': {'file_types_exposed': 'ASPX webshells',
'sensitivity_of_data': 'High (if exploited, could lead to '
'access to sensitive emails, PII, or '
'corporate data)'},
'date_detected': '2026-08',
'date_publicly_disclosed': '2026-08',
'description': 'A proof-of-concept (PoC) exploit for CVE-2026-62911, a severe '
'Microsoft Exchange Server vulnerability, has been publicly '
'released, enabling unauthenticated remote code execution '
'(RCE) with SYSTEM-level privileges on unpatched systems. The '
'flaw stems from an authentication capture-and-replay weakness '
'in the Exchange Mailbox Replication Proxy (MRSProxy) service, '
'which fails to enforce Extended Protection for Authentication '
'(EPA) on certain endpoints.',
'impact': {'brand_reputation_impact': 'High (public PoC availability '
'increases exploitation risk)',
'identity_theft_risk': 'High (if personally identifiable '
'information is accessed)',
'operational_impact': 'Potential unauthorized access, command '
'execution, and SYSTEM-level compromise of '
'Exchange servers',
'systems_affected': 'Microsoft Exchange Server 2016 CU23, Exchange '
'Server 2019 CU14 & CU15, Exchange Server '
'Subscription Edition RTM'},
'initial_access_broker': {'backdoors_established': 'ASPX webshells',
'entry_point': 'NTLM relay attack via MRSProxy '
'endpoint',
'high_value_targets': 'Exchange Server deployments '
'without EPA enforcement'},
'investigation_status': 'Publicly disclosed, PoC available, patches released',
'lessons_learned': 'Importance of timely patching, enforcing Extended '
'Protection for Authentication (EPA), and monitoring for '
'NTLM relay attacks. Public PoCs significantly increase '
'exploitation risk.',
'motivation': 'Exploitation for SYSTEM-level access, potential data '
'exfiltration, and unauthorized command execution',
'post_incident_analysis': {'corrective_actions': 'Patch management, EPA '
'enforcement, MRSProxy '
'endpoint restrictions, NTLM '
'relay monitoring',
'root_causes': 'Authentication capture-and-replay '
'weakness in MRSProxy service, lack '
'of EPA enforcement on '
'HTTP.sys-hosted endpoints'},
'recommendations': 'Immediately apply August 2026 security updates, verify '
'EPA settings, restrict MRSProxy endpoints, monitor for '
'NTLM relay activity, and remove unauthorized ASPX files.',
'references': [{'source': 'GitHub (Nguyen Van Hiep)'},
{'source': 'Microsoft Security Update Guide'},
{'source': 'Pwn2Own Berlin 2026 (DEVCORE)'}],
'response': {'containment_measures': 'Apply August 2026 security updates, '
'verify Extended Protection settings, '
'restrict MRSProxy endpoints',
'enhanced_monitoring': 'Monitor for unusual NTLM relay activity '
'and unexpected ASPX files in '
'IIS/Exchange directories',
'remediation_measures': 'Patch affected Exchange Server '
'versions, monitor for unusual NTLM '
'relay activity, remove unexpected ASPX '
'files'},
'stakeholder_advisories': 'Microsoft has released patches for supported '
'versions. Unpatched systems are at high risk.',
'threat_actor': 'Nguyen Van Hiep (researcher), Orange Tsai of DEVCORE '
'(initial discovery)',
'title': 'Critical Microsoft Exchange RCE Exploit Released: CVE-2026-62911 '
'PoC Unleashes SYSTEM-Level Threat',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-62911'}