Microsoft Exchange Server MRSProxy — missing channel-binding check, authentication bypass by capture-replay; public exploit code published 27 August 2026

CVE-2026-62911 — Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch

CVE-2026-62911 (CWE-294, Authentication Bypass by Capture-Replay) was patched in Microsoft's 11 August 2026 Exchange Server security release, at the time rated "Exploitation Less Likely" (Microsoft Security Response Center, 2026-08-11). NCSC-NL revised its own advisory (NCSC-2026-0289) on 2026-08-28 specifically to record the public proof-of-concept and raised its likelihood/damage assessment from medium/high to high/high as a result (NCSC-NL, 2026-08-28). The flaw sits in the MRSProxy endpoint Exchange exposes for cross-server mailbox moves: MRSProxy accepts Negotiate authentication but never validates channel bindings — the check Extended Protection for Authentication depends on (Franky's Web, 2026-08-27). Without that check, an attacker who captures or coerces a Negotiate/NTLM authentication exchange can relay it to MRSProxy and be treated as the relayed account rather than as themselves; Microsoft's own FAQ confirms the resulting access lets an attacker "take over the mailboxes of all Exchange users... send emails, read emails, download attachments" (Microsoft Security Response Center, 2026-08-11). The flaw was discovered by Orange Tsai of DEVCORE Research Team and demonstrated at Pwn2Own Berlin 2026 as one link in a three-vulnerability chain that together achieved SYSTEM-level remote code execution on Exchange, reported to Microsoft through the Zero Day Initiative (Franky's Web, 2026-08-27). Working exploit code was published on GitHub around 27 August 2026 — sixteen days after the patch — and MSRC's exploitability rating has not been revised since its 11 August publication despite the public proof-of-concept (Franky's Web, 2026-08-27). Affected are all Exchange Server builds below the August 2026 cumulative/security update across Exchange Server SE, 2019 (CU14 and CU15) and 2016 (CU23); there is no workaround via Exchange Emergency Mitigation, so the update must be installed directly, and updates for Exchange 2016 and 2019 are available only through Microsoft's paid Extended Security Updates (ESU) program — organizations without a current ESU license will not receive the patch (Franky's Web, 2026-08-27). No in-the-wild exploitation has been reported as of this writing.

MSRC's own CVSS vector scores the precondition as PR:L/UI:R — an "authorized attacker" with some user interaction — while Franky's Web's technical description frames the attacker as needing no valid Exchange credentials at all, since the relay mechanism itself supplies the authorization the vector presumes. Both readings converge on the same operational conclusion: any Exchange server below the August 2026 build should be treated as exposed to unauthenticated, mailbox-wide access once an attacker can coerce or capture a Negotiate authentication exchange directed at MRSProxy. Detection concept: authentication and session telemetry for MRSProxy/EWS access running under the Exchange server's own machine-account context but originating from unexpected source hosts — a legitimate mailbox move originates internally, not via relayed external traffic — with Windows Security Event 4624 Logon Type 3 network logons in that account context as the platform-specific anchor.