CVE-2026-62911: Public PoC Released for Microsoft Exchange Pre-Auth RCE Chain

CVE-2026-62911 chains three independently known exploitation primitives into a single pre-authentication remote code execution sequence requiring no user interaction on the target Exchange server.

The coercion phase starts with a PetitPotam request. The attacker sends an MS-EFSR RPC call to the Exchange server over the lsarpc named pipe, which forces the Windows host to initiate outbound NTLM authentication to an attacker-controlled SMB listener. PetitPotam has been a reliable coercion technique against Windows servers since 2021, and Exchange servers running the default EFSR service configuration respond without additional preconditions.

The relay phase exploits MRSProxy's missing EPA check. The attacker's SMB listener captures the incoming machine account NTLM authentication and immediately relays it over HTTPS to /EWS/MrsProxy.svc on the same Exchange server. Because the MRSProxy endpoint on HTTP.sys does not enforce EPA channel binding, it cannot detect that the authentication arrived over a different transport channel than the one the credential was originally issued for. The endpoint authenticates the session as the Exchange machine account, which holds write access to the Exchange installation file system.

The file write phase calls IMailbox_Config6. The authenticated WCF session invokes the IMailbox_Config6 operation with an attacker-controlled destination path and ASPX content as parameters. The Mailbox Replication Service writes the supplied file to the specified location, targeting any directory under the Exchange IIS installation path accessible over HTTP, typically within the ClientAccess or FrontEnd HttpProxy folder structure.

The execution phase delivers SYSTEM access. An HTTP GET request to the dropped ASPX webshell with a cmd query parameter causes IIS worker process w3wp.exe running in the Exchange application pool to execute the supplied operating system command and return output in the HTTP response. At this point the attacker has full command execution with Exchange service account permissions, which in most configurations includes local administrator rights.

The August 2026 patch fixes the vulnerability by implementing EPA enforcement on the MRSProxy endpoint, binding each Negotiate authentication token to the specific TLS session in which it was negotiated. Relayed tokens from a different TLS channel fail this check and authentication is rejected.

Microsoft Exchange Server remains one of the most widely deployed enterprise mail platforms globally. Shodan telemetry as of late August 2026 shows approximately 500,000 Exchange servers with their EWS or OWA endpoints directly reachable from the internet, the majority running versions within the CVE-2026-62911 affected range.

The affected version set covers Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. Exchange 2016 reached end of mainstream support in October 2025, meaning its patch for this vulnerability ships only through Extended Security Updates. Organizations still on Exchange 2016 without an active ESU contract have no vendor patch path and must deploy compensating controls or migrate immediately.

The attack's low technical bar amplifies the risk surface. The PoC released today on GitHub includes a self-contained Python script handling all four phases of the attack chain: attacker IP, target Exchange FQDN, and a desired webshell path. Operators with no prior Exchange knowledge can execute a complete pre-auth RCE in under five minutes against an unpatched target. Threat intelligence firms track Exchange RCE PoC releases as one of the highest-priority escalation signals for imminent mass exploitation.

Any Exchange server not yet running the patched builds from August 11, 2026, should be treated as imminently at risk. Confirming the build version takes under 30 seconds: run Get-ExchangeDiagnosticInfo in the Exchange Management Shell and compare the returned build number against the patched thresholds listed in the remediation section.

Orange Tsai of DEVCORE discovered and reported CVE-2026-62911 as part of a broader Exchange attack surface research program. DEVCORE has disclosed multiple critical Exchange vulnerabilities over the past four years, including the ProxyLogon chain (CVE-2021-26855) and ProxyRelay, each of which was subsequently exploited by nation-state actors within weeks of public disclosure.

The Pwn2Own Berlin 2026 demonstration chained CVE-2026-62911 with supplementary flaws to achieve SYSTEM-level code execution on a fully patched Exchange server at the competition's time of entry. The three-bug chain earned a $200,000 prize and was disclosed to Microsoft under responsible disclosure terms with a 90-day patch development window.

Nation-state groups with a history of targeting Exchange infrastructure include Chinese-nexus actors tracked as HAFNIUM, associated with ProxyLogon mass exploitation in March 2021, alongside BRONZE BUTLER and multiple North Korean Lazarus Group affiliates. Russian APT actors including COZY BEAR and SANDWORM have leveraged Exchange vulnerabilities for initial access in campaigns targeting NATO member organizations. Any of these groups is capable of operationalizing a public PoC within 24 to 72 hours of publication.

Ransomware operators represent the second highest-probability exploitation class. Exchange RCE delivers direct access to the highest-value data repository in most organizations. Post-exploitation patterns in the ProxyLogon and ProxyNotShell campaigns showed ransomware affiliates deploying web shells, running Active Directory reconnaissance, and establishing Cobalt Strike beacons within hours of gaining Exchange access.

The following timeline traces discovery, disclosure, and current exploitation risk for CVE-2026-62911.

The following indicators are derived from the documented attack chain mechanics. No specific attacker C2 infrastructure has been published alongside today's PoC release. Monitor these behavioral patterns to detect exploitation before attacker-specific network indicators become available.

Block or alert on IMailbox_Config6 in Exchange IIS logs immediately. This WCF operation name has no legitimate use case in inbound HTTP requests from external sources and its presence in MRSProxy access logs is a high-confidence exploitation signal.

Apply file integrity monitoring to Exchange IIS virtual directories. New ASPX files created in those directories outside of an Exchange update window should trigger an immediate incident response. The webshell write is the most reliable forensic indicator of a completed attack chain.

Two rules cover the webshell execution and persistence phases for CVE-2026-62911. Both carry status: experimental. Validate against your Exchange IIS and endpoint event telemetry before promoting to production.

Rule 1 — Webshell execution: IIS worker process spawning OS child processes in the Exchange application pool context. Near-zero false positives in environments that do not run custom Exchange scripts from IIS workers. Deploy via EDR process creation telemetry.

Rule 2 — Webshell persistence: New ASPX file creation in Exchange IIS virtual directories outside a known update cycle. File integrity monitoring on Exchange IIS paths is a recommended compensating control. The WAF rules below block the vulnerable WCF operation at the network layer before the file write can occur.

Apply the August 2026 Exchange security update as the primary remediation. The fix enforces Extended Protection for Authentication on the MRSProxy endpoint, which prevents the relay phase of the attack from succeeding. All steps below are compensating controls that reduce risk while patching is in progress.

Microsoft Exchange Server is the highest-value post-compromise target in most enterprise environments. A single Exchange server contains email for the entire organization including privileged communications between executives, legal counsel, and board members, active authentication tokens, calendar data revealing executive schedules, and cached credentials for connected cloud services.

The CVE-2026-62911 attack chain requires no credentials and no user interaction. An attacker with network access to SMB (port 445) on the Exchange server for the coercion phase and HTTPS (port 443) for the MRSProxy relay can complete the full attack in under five minutes. The $200,000 Pwn2Own payout reflects both the difficulty of the chain's discovery and the severity of its impact on a platform used by hundreds of thousands of organizations.

History confirms the urgency. Every major Exchange RCE of the past five years, including ProxyLogon, ProxyShell, ProxyNotShell, and OWASSRF, was exploited at mass scale by ransomware operators and nation-state actors within weeks of public disclosure. In the ProxyLogon case, HAFNIUM began exploitation before Microsoft's patch released. With the August 2026 patch already available for 21 days and a working PoC now public, defenders have no remaining time buffer.

CVE-2026-62911 joins a broader pattern of NTLM relay chains targeting enterprise perimeter services that also affected ServiceNow CVE-2026-18885 last week. The consistent fix across all of these cases is the same: enforce EPA on all WCF services that accept Negotiate authentication, patch before PoC release wherever possible, and deploy process creation monitoring on IIS worker processes as a standing baseline control.