Authentication bypass by capture-replay in Microsoft Exchange Server

CVE-2026-62911 is an authentication bypass in Microsoft Exchange Server's Mailbox Replication Service Proxy (MRSProxy). The HTTP.sys-hosted MRSProxy endpoint does not enforce Extended Protection for Authentication (EPA) — meaning it never validates NTLM channel bindings. An attacker coerces NTLM authentication from an Exchange machine account (via PetitPotam or similar), relays those credentials to the unprotected MRSProxy endpoint, and gains machine-account-level access. From there, a companion file-write primitive (ZDI-26-535) lets the attacker drop an ASPX webshell into an IIS directory, achieving SYSTEM-level RCE. Affected versions: Exchange Server 2016 CU23 (before 15.1.2507.72), Exchange Server 2019 CU14 (before 15.2.1544.44), Exchange Server 2019 CU15 (before 15.2.1748.49), and Exchange Server Subscription Edition RTM (before 15.2.2562.46).

Microsoft scored this HIGH 8.0 with PR:L/UI:R — but that label dramatically underrepresents the real threat. The published PoC demonstrates a pre-authentication attack: the coercion step requires zero credentials, the relay requires zero user interaction, and the endpoint is reachable from the internet on any Exchange server publishing OWA/EAS. Orange Tsai demonstrated the full chain at Pwn2Own Berlin 2026 for $200,000, and Nguyen Van Hiep's PoC is live on GitHub. Shadowserver counts 21,899 unpatched servers on the internet as of August 31. The CVSS vector's PR:L and UI:R flags are artifacts of the narrow CWE-294 classification — in the chained reality, this is unauthenticated, zero-click, network-reachable SYSTEM on Exchange. noisgate upgrades to CRITICAL.

Why this verdict

• Pre-auth chain despite PR:L label: The CVSS vector claims PR:L/UI:R, but the published PoC demonstrates that NTLM coercion (PetitPotam) requires zero credentials and zero user interaction. The relay-to-MRSProxy-to-webshell chain is fully automated and pre-authentication from the internet.
• Role multiplier — Exchange is canonical Tier-0/Tier-1 infrastructure: Exchange machine accounts hold AD credentials. SYSTEM on Exchange enables DCSync, credential harvesting from mailboxes, and lateral movement to domain controllers. The blast radius is domain → fleet. ≥95% of on-prem Exchange deployments occupy this high-value identity-adjacent role. This sets a CRITICAL floor.
• Public weaponized PoC with massive exposure surface: The hypnguyen1209/cve-2026-62911 PoC is freely available on GitHub. Shadowserver confirms 21,899 unpatched servers on the public internet. Orange Tsai's Pwn2Own demonstration proves chain reliability at $200K payout level.
• Historical precedent for mass exploitation: Every major Exchange NTLM/auth-bypass class (ProxyLogon, ProxyShell, ProxyNotShell) was mass-exploited within days-to-weeks of PoC release. Threat actors (Hafnium, DEV-0270, ransomware affiliates) have established Exchange exploitation playbooks.
• Default configuration is vulnerable: Extended Protection on the HTTP.sys MRSProxy endpoint is NOT enabled by default. The vast majority of Exchange deployments are vulnerable out of the box without explicit hardening.

Why not higher?

A 9.5 is already near ceiling. The only reason this is not a flat 10.0 is that the chain requires a companion path-traversal flaw (ZDI-26-535) in addition to the auth bypass, adding one link to the chain, and confirmed mass exploitation has not yet materialized as of September 3, 2026.

Why not lower?

The CRITICAL floor cannot be breached for Exchange Server. It is a canonical high-value-role component where ≥95% of on-prem installs sit in an identity-adjacent, internet-facing role. SYSTEM on Exchange yields domain-level blast radius. The public PoC eliminates any attacker-skill barrier, and 22,000 internet-exposed servers ensure the reachable population is significant. A HIGH rating would require evidence that the chain fails in practice — but Pwn2Own demonstration at $200K proves otherwise.

1. Enable Extended Protection for Authentication on ALL Exchange endpoints immediately — Run Get-ExchangeServer | ForEach { .\ExchangeExtendedProtectionManagement.ps1 -ExchangeServerNames $_.Name } from the Exchange management tools. This enforces EPA channel bindings on the MRSProxy HTTP.sys endpoint, breaking the NTLM relay chain at step 2. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Block outbound NTLM from Exchange servers — Configure Windows Firewall or network firewall to deny outbound SMB (445) and HTTP (80/443) from Exchange servers to non-approved destinations. This prevents the NTLM coercion callback in step 1. Deploy within 3 days.
3. Deploy file integrity monitoring on Exchange web directories — Monitor C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ recursively for new or modified .aspx files. Alert on any file creation not associated with a CU/SU installation. This catches webshell drops in step 3.
4. Restrict MRSProxy access at the network layer — If you do not perform cross-org mailbox migrations, block external access to the MRSProxy endpoint at your WAF or reverse proxy. This eliminates the relay target entirely.
5. Audit Exchange machine account privileges in AD — Ensure Exchange machine accounts are not members of privileged groups (Exchange Trusted Subsystem grants DCSync-equivalent rights by default in many deployments). Reducing these privileges limits post-compromise blast radius.

Run on each Exchange server as a local administrator. Example: .\Check-CVE-2026-62911.ps1 from an elevated PowerShell session. No external dependencies required.

#Requires -RunAsAdministrator
# Check-CVE-2026-62911.ps1
# Checks whether the local Exchange server is vulnerable to CVE-2026-62911
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction SilentlyContinue

    # Define patched build numbers
    $patchedBuilds = @{
        '15.1.2507' = 72   # Exchange 2016 CU23
        '15.2.1544' = 44   # Exchange 2019 CU14
        '15.2.1748' = 49   # Exchange 2019 CU15
        '15.2.2562' = 46   # Exchange SE RTM
    }

    # Get Exchange install path and version from registry
    $exSetupPath = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup' -ErrorAction Stop).MsiInstallPath
    $exSetupExe = Join-Path $exSetupPath 'bin\ExSetup.exe'

    if (-not (Test-Path $exSetupExe)) {
        Write-Host 'UNKNOWN - ExSetup.exe not found. Is Exchange installed on this host?'
        exit 2
    }

    $fileVersion = (Get-Item $exSetupExe).VersionInfo.FileVersion
    # Parse version: e.g. 15.2.1748.49
    $parts = $fileVersion -split '\.'
    if ($parts.Count -lt 4) {
        Write-Host "UNKNOWN - Could not parse Exchange version: $fileVersion"
        exit 2
    }

    $majorMinorCU = "$($parts[0]).$($parts[1]).$($parts[2])"
    [int]$buildRevision = $parts[3]

    if ($patchedBuilds.ContainsKey($majorMinorCU)) {
        $requiredRevision = $patchedBuilds[$majorMinorCU]
        if ($buildRevision -ge $requiredRevision) {
            Write-Host "PATCHED - Exchange version $fileVersion meets or exceeds patched build ($majorMinorCU.$requiredRevision)"
            exit 0
        } else {
            Write-Host "VULNERABLE - Exchange version $fileVersion is below patched build ($majorMinorCU.$requiredRevision). Apply KB5121576/KB5121575/KB5121574/KB5121573 immediately."
            exit 1
        }
    } else {
        # Check if version is newer than all known patched builds (future CU)
        $knownMax = [version]'15.2.2562.46'
        $currentVer = [version]$fileVersion
        if ($currentVer -gt $knownMax) {
            Write-Host "PATCHED - Exchange version $fileVersion is newer than the highest known affected build. Likely patched."
            exit 0
        }
        Write-Host "UNKNOWN - Exchange version $fileVersion does not match known affected CU baselines. Manual verification required."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $($_.Exception.Message)"
    exit 2
}

Sources

1. MSRC Advisory — CVE-2026-62911
2. Help Net Security — 22,000 Exchange Servers Exposed
3. CybersecurityNews — Public PoC for Exchange Pre-Auth RCE
4. GBHackers — PoC Released for CVE-2026-62911
5. SOC Prime — CVE-2026-62911 Detection Rules
6. BleepingComputer — 22,000 Exchange Servers Vulnerable
7. PoC Repository — hypnguyen1209/cve-2026-62911
8. CrowdStrike — August 2026 Patch Tuesday Analysis