CVE-2026-62911: Exchange Auth Bypass PoC Public, 21,000 Servers Still Internet-Exposed
Microsoft Exchange auth-bypass CVE-2026-62911 (CVSS 8.0) has been patched for nearly a month. Public PoC dropped the bar. Shadowserver still sees 21899 unpatched exposed IPs; 85% of on-prem Exchange in Germany unpatched.
Incident Overview
Microsoft Exchange Server auth-bypass CVE-2026-62911 (Microsoft CVSS 8.0, ZDI 8.1) is in a high-risk window. The patch shipped with the August 2026 security updates nearly a month ago. Shadowserver Foundation data from 31 August still shows 21899 Internet-facing Exchange instances unpatched—about 6200 in the US, about 5100 in Germany. Germany's BSI reported that as of 1 September, roughly 85% of on-prem Exchange in Germany remains unpatched. On 28 August, NCSC-NL confirmed public exploit code and raised the priority to «High», calling it «low-bar and easy to weaponize.»
The bug hits Exchange Server 2016, 2019, and Subscription Edition (SE). Root cause is an architectural split in the Mailbox Replication Service (MRSProxy): `/EWS/MRSProxy.svc` is hosted by IIS with Extended Protection for Authentication (EPA) enabled; `/Microsoft.Exchange.MailboxReplicationService.ProxyService` is hosted by HTTP.sys and does not enforce EPA. An attacker can use PetitPotam-style coercion to force the Exchange machine account into NTLM auth and relay it to the latter path.
From Auth Bypass to SYSTEM RCE
DEVCORE researcher Orange Tsai demoed the full chain at Pwn2Own Berlin 2026 and took a $200,000 bounty. After NTLM relay grants access, abuse WCF methods `IMailbox_Config6` (attacker-controlled file path) and `IMailbox_Connect` to drop an ASPX WebShell into the IIS directory, then RCE as SYSTEM. Late August a full Python PoC landed on GitHub (160 stars, 27 forks), dropping the bar further. No confirmed in-the-wild exploitation yet. Microsoft rated exploitation «Less Likely»; ZDI publicly disputed that rating.
Impact is not one box. Attacker can take over every mailbox in the org, read mail, pull attachments. Password-reset mail, financial data, and internal comms become lateral-movement fuel.
Remediation
Microsoft shipped fixes in the August 2026 updates: KB5121573 (Subscription Edition RTM), KB5121574 (2019 CU15), KB5121575 (2019 CU14), KB5121576 (2016 CU23). Ops:
- Apply the matching patch now. Confirm with an external scan, not merely that the update downloaded.
- If you cannot patch immediately, restrict MRSProxy endpoints to internal networks only.
- Exchange 2016 left mainstream support in October 2025. Security updates are ESU-only, and ESU ends October 2026. Plan the move to Subscription Edition.
- Hunt logs for anomalous NTLM auth against both MRSProxy paths and `IMailbox_*` method calls.
References
- Cybernews: Nearly 22,000 Microsoft Exchange servers exposed as exploit goes public
- CryptoRank/Forkast: 21,000 Exchange Servers Exposed to Public PoC Exploit