Executive brief
Microsoft Exchange Server exposes an unauthenticated mail synchronization service (MRSProxy) on an HTTP endpoint without channel binding protections. An attacker can intercept and relay a machine account's credentials to this service, then abuse it to write malicious code to the web server directory and execute commands with SYSTEM privileges. This completely compromises Exchange servers and any data they manage.
Technical details
The vulnerability is a combination of missing Extended Protection for Authentication (EPA) on the MRSProxy HTTP.sys binding and an arbitrary file write in the IMailbox_Config6() WCF method. The attack begins with PetitPotam (MS-EFSR) to trigger unauthenticated authentication from the Exchange machine account, capture the NTLM negotiate, and relay it to the unprotected MRSProxy endpoint at /Microsoft.Exchange.MailboxReplicationService.ProxyService. Because channel bindings are not enforced, the relay completes and the attacker gains access as the machine account, which holds ms-Exch-EPI-Token-Serialization permissions by default. The attacker can then call IMailbox_Config6() with an arbitrary file path (e.g., an ASPX webshell in C:\inetpub\wwwroot\) and IMailbox_Connect() to write the file to disk. Network reachability to the HTTP.sys endpoint and an intermediate server hosting MS-EFSR (typically the target Exchange server itself) are required, but no prior authentication is needed. The fix is available in KB articles for Exchange 2016 CU23, 2019 CU14/CU15, and SE RTM; however, older Exchange versions require Extended Security Updates (ESU) licenses.
Affected products
- Microsoft Exchange Server 2016 CU23 and earlier (15.1.2507.72 fixed)
- Microsoft Exchange Server 2019 CU14 (15.2.1544.43 fixed), CU15 (15.2.1748.48 fixed)
- Microsoft Exchange Server Subscription Edition RTM and earlier (15.2.2562.45 fixed)
Timeline
- 2026-08-11: disclosed: CVE-2026-62911 published by NVD
- 2026: exploited: Exploited by Orange Tsai (DEVCORE) at Pwn2Own Berlin 2026 as part of a 3-bug chain for $200,000 prize and full SYSTEM takeover
- 2026-08: patched: Fixes released via KB5121576 (2016), KB5121575 (2019 CU14), KB5121574 (2019 CU15), KB5121573 (SE RTM)