Critical Microsoft Exchange RCE Vulnerability Gets Public PoC

Key Takeaways

• A public Proof-of-Concept (PoC) exploit has been released for CVE-2026-62911, a critical vulnerability in Microsoft Exchange Server.
• While officially an elevation-of-privilege flaw, the PoC demonstrates how this vulnerability can lead to unauthenticated remote code execution (RCE) with SYSTEM-level privileges.
• The exploit targets the Exchange Mailbox Replication Proxy service (MRSProxy) and leverages NTLM relay attacks due to inadequate Extended Protection for Authentication.
• Microsoft released patches for this vulnerability in August 2026, and immediate deployment is crucial for affected on-premises Exchange Server versions.

Unauthenticated RCE Achieved on Microsoft Exchange with Public PoC

A proof-of-concept (PoC) exploit, now publicly available, targets CVE-2026-62911, a significant vulnerability within Microsoft Exchange Server. This flaw, initially categorized by Microsoft as an elevation-of-privilege issue, has been demonstrated to facilitate unauthenticated remote code execution (RCE), potentially leading to a complete SYSTEM-level compromise of susceptible Exchange environments.

The PoC, released on GitHub by security researcher Nguyen Van Hiep, focuses on the Exchange Mailbox Replication Proxy service, commonly known as MRSProxy. According to the exploit’s documentation, certain HTTP.sys-hosted MRSProxy endpoints fail to enforce Extended Protection for Authentication. This critical oversight allows attackers to capture and relay NTLM authentication from an Exchange machine account directly to the vulnerable service, circumventing authentication requirements.

The Attack Chain: From NTLM Relay to SYSTEM Compromise

Microsoft first disclosed CVE-2026-62911 in August 2026, describing it as an authentication-bypass capture-replay issue affecting on-premises deployments of Microsoft Exchange Server. While Microsoft’s official description notes that an authorized attacker could elevate privileges over a network, the recently published PoC significantly escalates the risk. It illustrates an NTLM relay path that, in specific configurations, may eliminate the necessity for any pre-existing Exchange credentials, enabling a pre-authentication RCE scenario.

Technical analysis reveals that Exchange exposes MRSProxy through multiple endpoints. While the IIS-hosted /EWS/MRSProxy.svc path is typically secured by Extended Protection, the HTTP.sys-hosted MailboxReplicationService ProxyService endpoint may not adequately validate channel bindings. This disparity creates an opportunity for an NTLM relay attack, where a captured machine-account authentication attempt can be successfully forwarded to the vulnerable Exchange service.

The attack sequence typically initiates with an attacker coercing an Exchange server to authenticate to an attacker-controlled listener, often utilizing techniques such as PetitPotam. The attacker then relays this captured NTLM authentication to a second vulnerable Exchange server. If this relay operation is successful, the machine account is treated as authenticated by MRSProxy, granting the attacker access to critical Exchange mailbox replication functionality.

The PoC reportedly abuses specific WCF methods within the replication service, including IMailbox_Config6 and IMailbox_Connect, as detailed in the PoC’s documentation. The IMailbox_Config6 method accepts a file path, while IMailbox_Connect can be leveraged to write content to that specified location. This mechanism enables an attacker to deploy an ASPX webshell into a web-accessible IIS or Exchange virtual directory. Once placed, the webshell can be remotely accessed to execute arbitrary commands under the Exchange service context, potentially achieving SYSTEM-level access as described in public reporting and technical analyses.

This vulnerability is part of a sophisticated three-bug chain that was famously demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026. The complete Exchange compromise earned a substantial $200,000 reward during the competition, highlighting the severe security implications of such chained authentication and service-level weaknesses.

Affected Versions and Remediation

The vulnerability impacts several versions of Microsoft Exchange Server, including Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. Microsoft released security updates addressing this issue in August 2026. Organizations running these on-premises Exchange Server versions must deploy these updates without delay.

Specifically, the fixed builds are: Exchange 2016 CU23 (version 15.1.2507.72), Exchange 2019 CU14 (version 15.2.1544.44), Exchange 2019 CU15 (version 15.2.1748.49), and Exchange Server Subscription Edition (version 15.2.2562.46). It is important to note that Exchange 2016 reached its end of support in October 2025. Organizations still using this version without Extended Security Updates (ESU) may lack a supported path for remediation, increasing their exposure to this and other vulnerabilities.

What You Should Do

• Apply Patches Immediately: Deploy Microsoft’s August 2026 security updates for Exchange Server without delay. Verify that all affected on-premises Exchange Server instances are running the latest patched versions.
• Verify Extended Protection: Ensure that Extended Protection for Authentication is correctly configured and enforced across all Exchange services, especially for MRSProxy endpoints.
• Limit Exposure: Reduce the external exposure of Exchange services to the absolute minimum necessary. Implement strict network segmentation and firewall rules to restrict access.
• Monitor NTLM Activity: Actively monitor network traffic for unusual or suspicious NTLM relay activity. Look for NTLM authentication attempts originating from unexpected sources or targeting sensitive services.
• Inspect Directories: Regularly audit and investigate unexpected ASPX files or other suspicious content appearing in Exchange and IIS virtual directories.
• Consider ESU for Exchange 2016: If still running Exchange 2016, ensure you have an active Extended Security Updates (ESU) license to receive critical security patches. Plan for migration to a supported version if not already underway.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.