Published on September 1, 2026
Public PoC Released for Microsoft Exchange Server Pre-auth RCE Vulnerability
Severity
High
Detail
A public proof-of-concept (PoC) exploit has been released for CVE-2026-62911, a Microsoft Exchange Server vulnerability associated with an authentication capture-and-replay weakness. While Microsoft classifies the vulnerability as an elevation-of-privilege issue, publicly available technical research describes an attack chain that can potentially result in unauthenticated remote code execution and SYSTEM-level compromise on vulnerable Exchange environments.
The PoC was published on GitHub by security researcher Nguyen Van Hiep and targets the Exchange Mailbox Replication Proxy (MRSProxy) service. According to the published technical analysis, an HTTP[.]sys-hosted MRSProxy endpoint may fail to enforce Extended Protection for Authentication, creating an opportunity to relay NTLM authentication from an Exchange machine account to the vulnerable service.
Microsoft disclosed CVE-2026-62911 in August 2026 as an authentication capture-and-replay vulnerability affecting on-premises Microsoft Exchange Server.
How?
The attack targets the MRSProxy service, which facilitates mailbox migration and replication operations within Microsoft Exchange environments. Researchers found that while the IIS-hosted /EWS/MRSProxy[.]svc endpoint may be protected by Extended Protection, the HTTP[.]sys-hosted MailboxReplicationService ProxyService endpoint may not properly validate channel bindings. This weakness allows attackers to relay NTLM authentication requests to a vulnerable Exchange server.
The attack begins by coercing a vulnerable Exchange server into authenticating to an attacker-controlled system using techniques such as PetitPotam. The attacker captures the authentication attempt and relays the NTLM credentials to a second vulnerable Exchange server hosting the exposed MRSProxy service.
If the relay is successful, the Exchange machine account is authenticated to MRSProxy and granted access to mailbox replication functionality. The PoC reportedly abuses Windows Communication Foundation (WCF) methods, including IMailbox_Config6 and IMailbox_Connect, to specify arbitrary file paths and cause Exchange to write attacker-controlled content to those locations.
An attacker may then write an ASPX web shell into a web-accessible IIS or Exchange virtual directory. Once the web shell is accessible via a browser, arbitrary commands can be executed on the compromised Exchange server, potentially resulting in SYSTEM-level access.
Affected Products
The following Microsoft Exchange versions are affected:
- Exchange Server 2016 CU23
- Exchange Server 2019 CU14
- Exchange Server 2019 CU15
- Exchange Server Subscription Edition RTM
Recommendations
Organizations using affected Exchange Server versions should:
- Apply Microsoft’s August 2026 security updates immediately.
- Verify that Extended Protection for Authentication is correctly configured across Exchange services.
- Reduce unnecessary external exposure of Exchange and MRSProxy services.
- Monitor for suspicious or unexpected NTLM authentication relay activity.
- Investigate unexpected ASPX files within Exchange and IIS web-accessible directories.
- Review Exchange and IIS logs for anomalous authentication and file-access activity.
Source
https://cybersecuritynews.com/poc-microsoft-exchange-server-pre-auth-rce/
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-62911