Microsoft Exchange Server

Recorded Future's H1 2026 Malware and Vulnerability Trends: two clusters reuse an identical post-exploitation tool stack across thirteen and ten unrelated initial CVEs

Recorded Future's Insikt Group published its H1 2026 Malware and Vulnerability Trends report on 3 September 2026, tracking 215 actively exploited CVEs in the first half of 2026, up 34% from 161 in H1 2025 (Recorded Future, 2026-09-03). Of those, 176 (82%) were network-accessible and 146 (68%) could be exploited without prior authentication; 142 of those 146 combined both properties, and 60 of 82 remote-code-execution CVEs combined network reachability, no authentication requirement and code execution in a single package (Recorded Future, 2026-09-03).

The report's most actionable finding for defenders is that post-exploitation tool-stack reuse persists across otherwise-unrelated initial-access vulnerabilities, regardless of vendor or product family (Recorded Future, 2026-09-03). A cluster the report designates StrikeShark applied an identical six-tool post-exploitation stack (SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer and SharpGPOAbuse) across thirteen separate CVEs spanning 2016 through 2025, reaching Microsoft Exchange, Microsoft SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro (Recorded Future, 2026-09-03); SharkLoader itself was previously profiled by Kaspersky's GReAT, which found it deploying Cobalt Strike via "Perfect DLL Hijacking" in a campaign whose confirmed victims spanned government and diplomatic entities, software developers and organizations in several other sectors and regions (Kaspersky Securelist, 2026-06-24). Separately, Storm-1175 linked Mimikatz, Impacket, PsExec, Rclone and Medusa ransomware across ten different initial CVEs; a China-linked cluster the report designates SHADOW-EARTH-053 separately reused Mimikatz following exploitation of CVE-2021-26855 in Microsoft Exchange Server (Recorded Future, 2026-09-03). Insikt Group mapped 114 of the 215 CVEs to MITRE ATT&CK: exploitation of a public-facing application was associated with 77 CVEs (68%), and 50 of those 77 also co-occurred with PowerShell, Windows Command Shell or Unix Shell execution; every one of the 28 web-shell-associated CVEs also carried the public-facing-application technique. The next most frequently associated post-exploitation behaviors across the mapped CVEs were system-information discovery, collection of data from the local system, transfer of further tooling into the compromised environment, and exfiltration over the command-and-control channel or web-protocol-based C2 traffic (Recorded Future, 2026-09-03).

The report's own defender-facing conclusion is explicit: because the same limited tool stack recurs regardless of which vulnerability supplied the initial foothold, detection engineering should chain exploitation telemetry from public-facing systems through to the post-exploitation behaviors these clusters repeat (credential dumping, remote-service execution via native administration mechanisms, bulk outbound data transfer, and ransomware staging) rather than treating each CVE alert as an isolated, one-off event (Recorded Future, 2026-09-03).

Builds on: 2026-06-27/kaspersky-great-strikeshark-loader-deploys-cobalt-strike-via

CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch

CVE-2026-62911 (CWE-294, Authentication Bypass by Capture-Replay) was patched in Microsoft's 11 August 2026 Exchange Server security release, at the time rated "Exploitation Less Likely" (Microsoft Security Response Center, 2026-08-11). NCSC-NL revised its own advisory (NCSC-2026-0289) on 2026-08-28 specifically to record the public proof-of-concept and raised its likelihood/damage assessment from medium/high to high/high as a result (NCSC-NL, 2026-08-28). The flaw sits in the MRSProxy endpoint Exchange exposes for cross-server mailbox moves: MRSProxy accepts Negotiate authentication but never validates channel bindings, the check Extended Protection for Authentication depends on (Franky's Web, 2026-08-27). Without that check, an attacker who captures or coerces a Negotiate/NTLM authentication exchange can relay it to MRSProxy and be treated as the relayed account rather than as themselves; Microsoft's own FAQ confirms the resulting access lets an attacker "take over the mailboxes of all Exchange users... send emails, read emails, download attachments" (Microsoft Security Response Center, 2026-08-11). The flaw was discovered by Orange Tsai of DEVCORE Research Team and demonstrated at Pwn2Own Berlin 2026 as one link in a three-vulnerability chain that together achieved SYSTEM-level remote code execution on Exchange, reported to Microsoft through the Zero Day Initiative (Franky's Web, 2026-08-27). Working exploit code was published on GitHub around 27 August 2026 (sixteen days after the patch) and MSRC's exploitability rating has not been revised since its 11 August publication despite the public proof-of-concept (Franky's Web, 2026-08-27). Affected are all Exchange Server builds below the August 2026 cumulative/security update across Exchange Server SE, 2019 (CU14 and CU15) and 2016 (CU23); there is no workaround via Exchange Emergency Mitigation, so the update must be installed directly, and updates for Exchange 2016 and 2019 are available only through Microsoft's paid Extended Security Updates (ESU) program; organizations without a current ESU license will not receive the patch (Franky's Web, 2026-08-27). No in-the-wild exploitation has been reported as of this writing.

MSRC's own CVSS vector scores the precondition as PR:L/UI:R, an "authorized attacker" with some user interaction (Microsoft Security Response Center, 2026-08-11), but Franky's Web's technical description, Germany's CERT-Bund and the Dutch NCSC-NL all independently characterise the flaw as exploitable by an attacker with no authentication at all. CERT-Bund states the public exploit "enabl[es] the complete remote takeover of systems without authentication" (CERT-Bund, 2026-08-28), and NCSC-NL's own advisory states plainly that the flaw "allows an unauthenticated attacker to execute arbitrary code" (NCSC-NL, 2026-08-28). A third-party technical reconstruction of the exploit chain narrows what "coerce or capture" requires in practice: MB VRED's own most plausible hypothesis (not a confirmed finding) is that the attacker needs an existing foothold on the internal, domain-joined network to issue an MS-EFSR (PetitPotam-style) coercion call against one Exchange server, capturing its machine-account authentication and relaying it to the MRSProxy endpoint on a different Exchange server ("The attacker sits inside the network, especially inside a domain-joined PC!") and the technique needs at least two Exchange servers in the environment, since "the captured hash cannot be relayed to itself." MB VRED frames this as requiring "lot of non-realistic conditions to be exploited in the real world", specifically, outbound connectivity from an Exchange server and inbound access on ports domain users do not normally reach it on, closing with "So, for the defensive guys, don’t be panic!" (MB VRED, 2026-08-13). Weighing two independent national CERTs' plain "unauthenticated" characterization against both the vendor's own CVSS labelling and this single, uncorroborated hypothesis about the network position it may actually require, any Exchange server below the August 2026 build should still be patched on the CERTs' own stated urgency, but MB VRED's own caveats are a reason for caution before assuming this is exploitable from the open internet without any existing foothold on the target's network. Detection concept: authentication and session telemetry for MRSProxy/EWS access running under the Exchange server's own machine-account context but originating from unexpected source hosts, a legitimate mailbox move originates internally, not via relayed external traffic, with Windows Security Event 4624 Logon Type 3 network logons in that account context as the platform-specific anchor.

CVE-2026-42897 Exchange OWA, EM Service auto-mitigation depends on outbound connectivity to officemitigations.microsoft.com

UPDATE (originally covered 2026-05-15 / deep-dive 2026-05-16): The Microsoft Exchange Team Blog post addressing CVE-2026-42897 was last modified 2026-05-17 to clarify an operational dependency that defenders must verify on every Exchange Mailbox host: the Exchange Emergency Mitigation Service (EM Service / EEMS) (which auto-applies the URL-Rewrite mitigation labelled M2.1.x) only delivers that mitigation when it can reach officemitigations.microsoft.com over outbound HTTPS. Segmented on-premises Exchange 2016 / 2019 / Subscription-Edition deployments that block direct outbound HTTPS from the Mailbox role will therefore not have received the automatic mitigation and remain exposed to the actively-exploited OWA stored-XSS chain.

The CVE remains CISA KEV-listed (added 2026-05-15) with no permanent cumulative-update fix as of 2026-05-18; Microsoft states verbatim "We are working on developing and testing a more permanent fix which we will provide when it meets our quality standards." Exchange Online is unaffected. Operational verification per server: Get-ExchangeDiagnosticInfo -Server <server> -Process EdgeTransport -Component EmergencyMitigation returns Status: Active and rule M2.1.x applied; manual application on hosts that cannot reach the mitigation service: .\EOMT.ps1 -CVE "CVE-2026-42897" from an elevated Exchange Management Shell, or apply the documented URL Rewrite rule by hand.

Builds on: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376