A new public proof-of-concept exploit has surfaced for CVE-2026-62911, a Microsoft Exchange vulnerability that lets attackers achieve remote code execution with no authentication required. While Microsoft categorized it as an elevation‐of‐privilege weakness, the PoC shows that, given certain configurations, attackers can escalate this into unauthenticated SYSTEM-level compromise. Administrators must act fast to assess exposure and apply patches.
What the Vulnerability Entails
The weakness stems from an authentication capture-and-replay flaw in Exchange’s mailbox replication proxy service, known as MRSProxy. The exploit focuses on an HTTP.sys-hosted endpoint of MRSProxy which, unlike the IIS-hosted /EWS/MRSProxy.svc path protected by Extended Protection, does not enforce channel binding validation. Attackers can relay NTLM authentication from a compromised Exchange machine account to the vulnerable HTTP.sys endpoint, effectively bypassing typical protections.
The attack starts by tricking an Exchange server into authenticating to an attacker’s listener—techniques like PetitPotam are possible triggers. The captured NTLM credentials can then be relayed to another Exchange server exposing the HTTP.sys MRSProxy endpoint. Once authenticated as a machine account, the attacker can invoke WCF methods within the replication service—specifically IMailbox_Config6 and IMailbox_Connect. These methods allow writing files to arbitrary paths, making it possible to drop an ASPX webshell into a directory served by IIS or Exchange. If successful, that gives remote code execution at SYSTEM privileges.
Affected Versions & Mitigations
The vulnerability impacts several Exchange Server versions: 2016 CU23; 2019 CU14 and CU15; and Exchange Server Subscription Edition RTM. The fix comes via Microsoft’s August 2026 security updates. Patched builds include Exchange 2016 CU23 (v 15.1.2507.72), 2019 CU14 (15.2.1544.44), 2019 CU15 (15.2.1748.49), and Subscription Edition (15.2.2562.46). It’s worth noting that Exchange 2016 exited mainstream support in October 2025—organizations relying on Extended Security Updates may lack viable corrective paths if they’re out-of-date.
Beyond patching, admins should verify that Extended Protection for Authentication is properly configured, especially for paths exposed via HTTP.sys. They should also limit exposure of Exchange services, monitor for unexpected NTLM relay traffic, and regularly scan for unauthorized ASPX files in IIS or Exchange virtual directories.
This issue traces back to work by Orange Tsai of DEVCORE, staged during Pwn2Own Berlin 2026. It was part of a three-bug chain that highlighted how authentication bypasses plus service-level misconfigurations can lead to full server compromise. The vulnerability drew a $200,000 reward for its discoverer, underlining its severity.
Why this matters. Microsoft Exchange servers are widely used in enterprises worldwide. A vulnerability that permits unauthenticated remote code execution with SYSTEM privileges is among the worst kinds of flaws—attackers can install backdoors, exfiltrate data, or pivot across networks. The fact that a public PoC now exists means exploits could rapidly spread. This is a wake-up call: security teams must confirm patch status, harden NTLM relay defenses, and review service exposure immediately to avert potentially catastrophic breaches.
