CVE-2026-62911 Exchange Server Pre-Auth RCE PoC Released

TL;DR

Security researchers publicly disclosed technical details for an Exchange Server pre-auth RCE flaw tracked as CVE-2026-62911. The critical vulnerability allows unauthenticated attackers on local networks to achieve remote code execution as SYSTEM. Administrators must apply official Microsoft patches immediately to safeguard exposed mail servers.

Why It Matters

Security researcher Orange Tsai demonstrated the zero-day attack at Pwn2Own Berlin 2026 to win a $200,000 prize. Furthermore, security researchers from MB VRED recreated the exploit chain and published full technical analysis. A developer subsequently published working public proof-of-concept exploit code on GitHub.

Because on-premises Exchange servers handle vital enterprise communications, an unauthenticated takeover creates severe operational danger. Attackers can execute commands with highest SYSTEM privileges across corporate domains. An estimated hundreds of thousands of on-premises Exchange installations worldwide remain attractive targets for cybercriminals.

How the Attack Works

The attack targets the Mailbox Replication Proxy Service (MRSProxy) running inside the MSExchangeMailboxReplication process. Exchange exposes this service through an HTTP.sys endpoint that lacks Extended Protection protections. Consequently, an attacker inside the local network can initiate an NTLM relay attack.

The attacker first forces an Exchange server machine account to authenticate using the PetitPotam RPC technique. Next, the attacker relays that captured machine authentication to a secondary Exchange server. As the MB VRED security team analysis explains, “The HTTP.sys endpoint accepts Negotiate auth but never checks channel bindings.”

Exchange machine accounts possess serialization rights by default. Therefore, the WCF service grants full administrative access to the attacker. The adversary then calls internal mailbox configuration routines to write arbitrary files to disk. Specifically, the method writes files without checking file extensions. As the report notes, “Point it at an IIS directory, call IMailbox_Connect(), and a file lands on disk.” The attacker drops an ASPX webshell and gains total control through this Exchange Server pre-auth RCE chain.

Affected Versions

This critical vulnerability affects several on-premises Microsoft Exchange Server deployments:

• Microsoft Exchange Server 2016 CU23 (prior to build 15.1.2507.72 / KB5121576)
• Microsoft Exchange Server 2019 CU14 (prior to build 15.2.1544.43 / KB5121575)
• Microsoft Exchange Server 2019 CU15 (prior to build 15.2.1748.48 / KB5121574)
• Microsoft Exchange Server SE RTM (prior to build 15.2.2562.45 / KB5121573)

Patch or Mitigation Steps

Microsoft addressed CVE-2026-62911 during the August 2026 security updates. System administrators should consult the official Microsoft security update guide and apply the designated Knowledge Base updates immediately.

Because Exchange Server 2016 reached end-of-life status in October 2025, security updates require active Extended Security Updates (ESU). Organizations lacking ESU coverage must upgrade their environments without delay. Additionally, network administrators should restrict RPC traffic and enforce strict SMB signing to prevent unauthorized authentication relaying.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.