# CVE-2026-62911: Microsoft Exchange Server privilege escalation via NTLM relay to MRSProxy

Source: https://junglewise.ai/threats/cve-2026-62911-microsoft-exchange-server-privilege-escalation-via-ntlm-relay-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62911 · Severity: high · CVSS 8 · Published 2026-08-11

Microsoft Exchange Server exposes an unauthenticated mail synchronization service (MRSProxy) on an HTTP endpoint without channel binding protections. An attacker can intercept and relay a machine account's credentials to this service, then abuse it to write malicious code to the web server directory and execute commands with SYSTEM privileges. This completely compromises Exchange servers and any data they manage.

Technologies: [Microsoft Exchange Server 2016](https://junglewise.ai/threats/technologies/exchange-server-2016), [Microsoft Exchange Server 2019](https://junglewise.ai/threats/technologies/exchange-server-2019), [Microsoft Exchange Server Subscription Edition](https://junglewise.ai/threats/technologies/exchange-server-subscription-edition). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-62911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62911 being exploited in the wild.

**How severe is CVE-2026-62911?** High severity, with a CVSS score of 8, published 11 August 2026.

**Which products and versions are affected?** Microsoft Exchange Server 2016 CU23 and earlier (15.1.2507.72 fixed); Microsoft Exchange Server 2019 CU14 (15.2.1544.43 fixed), CU15 (15.2.1748.48 fixed); Microsoft Exchange Server Subscription Edition RTM and earlier (15.2.2562.45 fixed).

**Is there a fix for CVE-2026-62911?** A patch was published on 2026-08: Fixes released via KB5121576 (2016), KB5121575 (2019 CU14), KB5121574 (2019 CU15), KB5121573 (SE RTM) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62911 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62911?** Check whether you run Microsoft Exchange Server 2016, Microsoft Exchange Server 2019 or Microsoft Exchange Server Subscription Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combination of missing Extended Protection for Authentication (EPA) on the MRSProxy HTTP.sys binding and an arbitrary file write in the IMailbox_Config6() WCF method. The attack begins with PetitPotam (MS-EFSR) to trigger unauthenticated authentication from the Exchange machine account, capture the NTLM negotiate, and relay it to the unprotected MRSProxy endpoint at /Microsoft.Exchange.MailboxReplicationService.ProxyService. Because channel bindings are not enforced, the relay completes and the attacker gains access as the machine account, which holds ms-Exch-EPI-Token-Serialization permissions by default. The attacker can then call IMailbox_Config6() with an arbitrary file path (e.g., an ASPX webshell in C:\inetpub\wwwroot\) and IMailbox_Connect() to write the file to disk. Network reachability to the HTTP.sys endpoint and an intermediate server hosting MS-EFSR (typically the target Exchange server itself) are required, but no prior authentication is needed. The fix is available in KB articles for Exchange 2016 CU23, 2019 CU14/CU15, and SE RTM; however, older Exchange versions require Extended Security Updates (ESU) licenses.

## Affected products

- Microsoft Exchange Server 2016 CU23 and earlier (15.1.2507.72 fixed)
- Microsoft Exchange Server 2019 CU14 (15.2.1544.43 fixed), CU15 (15.2.1748.48 fixed)
- Microsoft Exchange Server Subscription Edition RTM and earlier (15.2.2562.45 fixed)

## Timeline

- 2026-08-11: disclosed: CVE-2026-62911 published by NVD
- 2026: exploited: Exploited by Orange Tsai (DEVCORE) at Pwn2Own Berlin 2026 as part of a 3-bug chain for $200,000 prize and full SYSTEM takeover
- 2026-08: patched: Fixes released via KB5121576 (2016), KB5121575 (2019 CU14), KB5121574 (2019 CU15), KB5121573 (SE RTM)

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911)
- [https://github.com/hypnguyen1209/CVE-2026-62911](https://github.com/hypnguyen1209/CVE-2026-62911)

## Related threats

- [Microsoft Exchange Server cryptographic signature verification privilege escalation](https://junglewise.ai/threats/cve-2026-87696-improper-verification-of-cryptographic-signature-in-microsoft)
- [Microsoft Exchange Server privilege escalation via untrusted control sphere](https://junglewise.ai/threats/cve-2026-87695-inclusion-of-functionality-from-untrusted-control-sphere-in)
- [Microsoft Exchange Server deserialization privilege elevation](https://junglewise.ai/threats/cve-2026-87692-deserialization-of-untrusted-data-in-microsoft-exchange-server)
- [Microsoft Exchange Server deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-55009-microsoft-exchange-server-deserialization-privilege-escalation)
- [Microsoft Exchange Server cross-site scripting spoofing vulnerability](https://junglewise.ai/threats/cve-2026-55008-microsoft-exchange-server-cross-site-scripting-spoofing)