A public proof-of-concept (PoC) repository has garnered attention for a pre-authentication remote code execution chain targeting Microsoft Exchange Server.
This repository highlights CVE-2026-62911, an Exchange authentication-bypass vulnerability disclosed following Pwn2Own Berlin 2026.
Defenders should treat the published code as unverified until it is independently validated in an isolated laboratory environment.
Both the official advisory and the Zero Day Initiative (ZDI) describe CVE-2026-62911 as an elevation-of-privilege issue involving capture-replay authentication bypass, rather than a standalone unauthenticated remote code execution (RCE) vulnerability.
Exchange Flaw Used in the Exploitation Chain
ZDI tracks CVE-2026-62911 as ZDI-26-538 and notes that it affects on-premises Microsoft Exchange deployments. According to ZDI, the vulnerability stems from poor session management in authorization.
Although authentication is generally required, the advisory indicates that the existing authentication mechanism can be bypassed. This flaw can lead to arbitrary code execution as SYSTEM when combined with other vulnerabilities.
The vulnerability was part of a three-bug exchange chain demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026, in which it reportedly achieved SYSTEM-level code execution and earned a $200,000 reward.
The newly circulating PoC repository details an attack sequence centered on Exchange’s Mailbox Replication Service Proxy (MRSProxy).
It claims that an attacker could coerce NTLM authentication from one Exchange server and relay that authentication to another server’s MRSProxy service. This could exploit Windows Communication Foundation (WCF) mailbox-replication operations to enable server-side file writes.
The reported method for achieving code execution involves writing an ASPX payload to an IIS-accessible directory and then requesting it via the Exchange web server.
This would convert the file-writing capability into web shell-based remote command execution, operating under the Exchange process context as SYSTEM.
The technical claims focus on an HTTP.sys-hosted MRSProxy endpoint that accepts Negotiate authentication but allegedly lacks Extended Protection for Authentication (EPA) channel-binding enforcement.
In an NTLM relay scenario, the absence of EPA can prevent the target service from confirming that authentication was completed over the intended protected channel.
Another concern is a reported arbitrary-path file-write flaw within Exchange’s mailbox-replication functionality. ZDI has also documented an external control-of-file-path flaw, ZDI-26-535, stating that inadequate validation of a user-supplied path before file operations could enable arbitrary code execution.
This distinction is crucial operationally: CVE-2026-62911 should not be viewed as the sole bug accountable for the reported outcome. The capability for pre-auth RCE relies on chaining authentication bypass or relay behaviors, authorization weaknesses, coercion, and arbitrary file-write conditions.
Affected Exchange Versions
Public CVE records indicate affected builds across Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, as well as Exchange Server Subscription Edition RTM.
The fixed build thresholds are as follows: Exchange 2016 CU23 15.1.2507.72, Exchange 2019 CU14 15.2.1544.44, Exchange 2019 CU15 15.2.1748.49, and Exchange SE RTM 15.2.2562.46.
It is worth noting that Exchange 2016 reached its end of support in October 2025, meaning organizations lacking Extended Security Updates may have limited patch options.
Organizations should immediately apply Microsoft’s August 2026 Exchange security updates, verify their installed build numbers, and check whether MRSProxy endpoints are externally reachable. Security teams should also take the following actions:
- Enable and validate Extended Protection across Exchange services.
- Restrict unnecessary inbound access to Exchange and administrative interfaces.
- Monitor for unusual NTLM authentication patterns among Exchange servers.
- Search for recently created ASPX files in IIS and Exchange web directories.
- Review telemetry from IIS, HTTP.sys, Exchange, and endpoints for any anomalous mailbox-replication activities.
The availability of publicly available exploit material lowers the barrier to testing and potential abuse, making rapid patching and exposure reduction critical for Exchange administrators.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
 repository has garnered attention for a pre-authentication remote code execution chain targeting Microsoft Exchange Server.){kind=link}