A public proof-of-concept exploit has been released for CVE-2026-62911, a Microsoft Exchange Server vulnerability linked to an authentication capture-and-replay weakness.
While Microsoft classifies the issue as an elevation-of-privilege flaw, the published research describes an attack chain that can lead to unauthenticated remote code execution and a SYSTEM-level compromise on vulnerable Exchange environments.
The PoC, published on GitHub by researcher Nguyen Van Hiep, targets the Exchange Mailbox Replication Proxy service, commonly known as MRSProxy.
The exploit documentation claims that a reachable HTTP. sys-hosted MRSProxy endpoint does not enforce Extended Protection for Authentication, enabling an attacker to relay NTLM authentication from an Exchange machine account to the service.
Microsoft disclosed CVE-2026-62911 in August 2026 as an authentication-bypass capture-replay issue affecting on-premises Microsoft Exchange Server.
Public PoC For Exchange Server Pre-Auth RCE
Microsoft’s public description states that an authorized attacker could elevate privileges over a network. In contrast, the available PoC increases practical risk by demonstrating an NTLM relay path that may eliminate the need for prior Exchange credentials in certain configurations.
According to the technical analysis, Exchange exposes MRSProxy through separate endpoints. Extended Protection protects the IIS-hosted /EWS/MRSProxy.svc path.
However, the HTTPsys-hosted MailboxReplicationService ProxyService endpoint may not validate channel bindings. This creates a relay opportunity where a captured machine-account authentication attempt can be forwarded to the vulnerable Exchange service.
The attack chain begins by coercing an Exchange server to authenticate to an attacker-controlled listener through a technique such as PetitPotam. The attacker can then relay the NTLM authentication to a second vulnerable Exchange server.
If the relay succeeds, the machine account is treated as authenticated by MRSProxy. It receives access to Exchange mailbox replication functionality.
The PoC reportedly abuses WCF methods within the replication service, including IMailbox_Config6 and IMailbox_Connect. The first method accepts a file path, while the second may cause Exchange to write content to that location.
An attacker could attempt to place an ASPX webshell into a web-accessible IIS or Exchange virtual directory, then access the file remotely to execute commands under the Exchange service context. Public reporting and technical analysis describe a potential SYSTEM-level outcome.
The vulnerability is associated with a three-bug chain demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026. The Exchange compromise earned a $200,000 reward during the competition, underscoring the security impact of chained authentication and service-level weaknesses.
Affected products include Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. Organizations should deploy Microsoft’s August 2026 Exchange security updates immediately.
Fixed builds include Exchange 2016 CU23 (version 15.1.2507.72), Exchange 2019 CU14 (version 15.2.1544.44), Exchange 2019 CU15 (version 15.2.1748.49), and Exchange Server Subscription Edition (version 15.2.2562.46).
Exchange 2016 reached end of support in October 2025, meaning organizations without Extended Security Updates may not have a supported remediation path.
Administrators should also verify Extended Protection settings, reduce unnecessary exposure of Exchange services, monitor for unusual NTLM relay activity, and investigate unexpected ASPX files in Exchange and IIS directories.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Public PoC Released for Microsoft Exchange Server Pre-auth RCE Vulnerability appeared first on Cyber Security News.