--- schema: 1 kind: vulnerability title: "CVE-2026-62911 — Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch" headline: "A working public exploit for an Exchange mailbox-move endpoint lands sixteen days after Patch Tuesday, and MSRC's exploitability rating has not moved" summary: > CVE-2026-62911 (CVSS3.1 8.0), patched in Microsoft's 11 August 2026 Exchange Server security release and originally rated "Exploitation Less Likely," now has working exploit code published on GitHub (27 August 2026). The flaw is a missing channel-binding check on the MRSProxy mailbox-move endpoint that lets a relayed Negotiate/NTLM authentication exchange be treated as the relayed account, giving an attacker who can capture or coerce that exchange full mailbox access across the organization. No in-the-wild exploitation is reported. discovered_at: "2026-08-29T04:09:36Z" updated_at: "2026-09-01T04:40:00Z" event_date: "2026-08-27" run_id: 2026-08-29T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, auth-bypass, poc-public, patch-available] regions: [global] sectors: [public-sector, finance, healthcare, energy, telco] entities: [] techniques: [T1190, T1557, T1068] affected_products: ["Microsoft Exchange Server 2016", "Microsoft Exchange Server 2019", "Microsoft Exchange Server Subscription Edition"] cves: - id: CVE-2026-62911 cvss: "8.0 (CVSS3.1)" epss: null type: auth-bypass vector: user-interaction auth: pre-auth status: [poc-public, patch-available] affected: "Exchange Server SE RTM below 15.2.2562.46; Exchange 2019 CU15 below 15.2.1748.49; Exchange 2019 CU14 below 15.2.1544.44; Exchange 2016 CU23 below 15.1.2507.72" fixed: "Exchange SE RTM 15.2.2562.46 (KB5121573); Exchange 2019 CU15 15.2.1748.49 (KB5121574); Exchange 2019 CU14 15.2.1544.44 (KB5121575); Exchange 2016 CU23 15.1.2507.72 (KB5121576) — no Emergency Mitigation workaround exists" sources: - url: "https://www.frankysweb.de/en/exchange-public-exploit-for-critical-vulnerability-cve-2026-62911/" publisher: "Franky's Web" date: "2026-08-27" role: primary - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911" publisher: "Microsoft Security Response Center" date: "2026-08-11" role: primary - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0289" publisher: "NCSC-NL advisory NCSC-2026-0289 (rev. 1.0.1)" date: "2026-08-28" role: corroborating - url: "https://www.heise.de/news/Exchange-Sicherheitsluecke-85-Prozent-der-On-Prem-Server-in-Deutschland-anfaellig-11434785.html" publisher: "heise Security" date: "2026-08-31" role: corroborating - url: "https://social.bund.de/@certbund/117171896801475447" publisher: "CERT-Bund (BSI)" date: "2026-08-28" role: primary - url: "https://vred.mbbank.com.vn/p/analysis-of-exchange-server-pre-auth" publisher: "MB VRED" date: "2026-08-13" role: corroborating closed_sources: [] evidence: - quote: "Working exploit code has surfaced for the critical Exchange vulnerability CVE-2026-62911 from the August update." publisher: "Franky's Web" - quote: "This endpoint accepts Negotiate authentication but does not check the so-called channel bindings. It is precisely this check that enforces Extended Protection." publisher: "Franky's Web" - quote: "Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network." publisher: "Microsoft Security Response Center" - quote: "What privileges could be gained by an attacker who successfully exploited the vulnerability? The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments." publisher: "Microsoft Security Response Center" - quote: "A PoC exploit has been published for the critical vulnerability CVE-2026-62911 in Microsoft Exchange, enabling the complete remote takeover of systems without authentication. (translated from German)" original: "Für die kritische Schwachstelle CVE-2026-62911 in Microsoft Exchange wurde ein PoC-Exploit veröffentlicht, der die vollständige Übernahme von Systemen aus der Ferne ohne Authentifizierung ermöglicht." publisher: "CERT-Bund (BSI)" - quote: "This vulnerability allows an unauthenticated attacker to execute arbitrary code. (translated from Dutch)" original: "Deze kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende in staat om willekeurige code uit te voeren." publisher: "NCSC-NL" - quote: "Currently, however, around 85% of on-premises Exchange servers in Germany are still vulnerable to this vulnerability. (translated from German)" original: "Aktuell sind jedoch noch rund 85% der on-premises Exchange-Server in Deutschland für diese Schwachstelle verwundbar." publisher: "CERT-Bund (BSI)" - quote: "Currently, however, we are only aware of 9 Exchange servers 2016/2019 in Germany on which patches issued under ESU are installed. (translated from German)" original: "Aktuell sind uns in Deutschland jedoch nur 9 Exchange-Server 2016/2019 bekannt, auf denen im Rahmen von ESU herausgegebene Patches installiert sind" publisher: "BSI, via heise Security" - quote: "The attacker sits inside the network, especially inside a domain-joined PC!" publisher: "MB VRED" - quote: "This one works only for multiple Exchange servers setup because the captured hash cannot be relayed to itself!" publisher: "MB VRED" - quote: "It requires lot of non-realistic conditions to be exploited in the real world:" publisher: "MB VRED" - quote: "So, for the defensive guys, don’t be panic!" publisher: "MB VRED" verification: multi-source sourcing_note: > MSRC's own CVSS vector scores the precondition as PR:L/UI:R ("authorized attacker"); CERT-Bund (BSI), NCSC-NL and Franky's Web all independently and explicitly describe the flaw as exploitable by an unauthenticated attacker. This entry's `auth: pre-auth` follows the weight of that independent national-CERT and researcher evidence over the vendor's own CVSS labelling; see body. A single third-party technical write-up (MB VRED, a bank security research team) offers its own hypothesis — not a confirmed finding — that the practical precondition is an attacker already positioned on the internal domain network relaying one Exchange server's coerced machine-account authentication to a second Exchange server; MB VRED itself frames real-world exploitation as needing "lot of non-realistic conditions." This entry presents that hypothesis alongside, not as overriding, the national-CERT "unauthenticated" characterization; see body. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Verify the installed build number on every Exchange server directly against the August 2026 fixed builds (KB5121573/74/75/76) — do not rely on patch-cycle records showing the update was scheduled or pushed; German BSI telemetry shows most comparable on-prem Exchange operators have not actually applied it two weeks after release." updates: - at: "2026-09-01T04:40:00Z" run_id: 2026-09-01T0411Z-intel type: update summary: > Germany's CERT-Bund (BSI) disclosed on 2026-08-28 that roughly 85% of on-premises Exchange servers in Germany remain vulnerable to CVE-2026-62911 despite the patch having shipped over two weeks earlier and public exploit code being live; BSI has been proactively notifying network operators since 2026-08-14. For Exchange 2016/2019, now supported only through paid Extended Security Updates, BSI knows of just nine German servers with the ESU patch installed. Separately, CERT-Bund and NCSC-NL — both independently, and neither cited for this point before now — explicitly describe the flaw as exploitable without authentication at all, against MSRC's own CVSS vector alone (PR:L/UI:R, "authorized attacker"); this entry now describes the flaw as exploitable pre-authentication, corrected from an earlier post-auth framing, to follow that weight of evidence. A third-party technical write-up (MB VRED) offers its own hypothesis, not a confirmed finding, narrowing what that "unauthenticated" characterization might mean in practice: an attacker with an existing foothold on the internal domain network coercing one Exchange server's machine-account authentication via MS-EFSR/PetitPotam and relaying it to a second Exchange server's MRSProxy endpoint, needing at least two Exchange servers in the environment — presented alongside, not overriding, this entry's national-CERT-weighted auth:pre-auth determination. MB VRED's own caveat that real-world exploitation needs "lot of non-realistic conditions" is included for balance. fields: [sources, evidence, actions, cves, sourcing_note, body] migrated_from: null --- CVE-2026-62911 (CWE-294, Authentication Bypass by Capture-Replay) was patched in Microsoft's 11 August 2026 Exchange Server security release, at the time rated "Exploitation Less Likely" ([Microsoft Security Response Center, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911)). NCSC-NL revised its own advisory (NCSC-2026-0289) on 2026-08-28 specifically to record the public proof-of-concept and raised its likelihood/damage assessment from medium/high to high/high as a result ([NCSC-NL, 2026-08-28](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0289)). The flaw sits in the MRSProxy endpoint Exchange exposes for cross-server mailbox moves: MRSProxy accepts Negotiate authentication but never validates channel bindings — the check Extended Protection for Authentication depends on ([Franky's Web, 2026-08-27](https://www.frankysweb.de/en/exchange-public-exploit-for-critical-vulnerability-cve-2026-62911/)). Without that check, an attacker who captures or coerces a Negotiate/NTLM authentication exchange can relay it to MRSProxy and be treated as the relayed account rather than as themselves; Microsoft's own FAQ confirms the resulting access lets an attacker "take over the mailboxes of all Exchange users... send emails, read emails, download attachments" ([Microsoft Security Response Center, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911)). The flaw was discovered by Orange Tsai of DEVCORE Research Team and demonstrated at Pwn2Own Berlin 2026 as one link in a three-vulnerability chain that together achieved SYSTEM-level remote code execution on Exchange, reported to Microsoft through the Zero Day Initiative ([Franky's Web, 2026-08-27](https://www.frankysweb.de/en/exchange-public-exploit-for-critical-vulnerability-cve-2026-62911/)). Working exploit code was published on GitHub around 27 August 2026 — sixteen days after the patch — and MSRC's exploitability rating has not been revised since its 11 August publication despite the public proof-of-concept ([Franky's Web, 2026-08-27](https://www.frankysweb.de/en/exchange-public-exploit-for-critical-vulnerability-cve-2026-62911/)). Affected are all Exchange Server builds below the August 2026 cumulative/security update across Exchange Server SE, 2019 (CU14 and CU15) and 2016 (CU23); there is no workaround via Exchange Emergency Mitigation, so the update must be installed directly, and updates for Exchange 2016 and 2019 are available only through Microsoft's paid Extended Security Updates (ESU) program — organizations without a current ESU license will not receive the patch ([Franky's Web, 2026-08-27](https://www.frankysweb.de/en/exchange-public-exploit-for-critical-vulnerability-cve-2026-62911/)). No in-the-wild exploitation has been reported as of this writing. MSRC's own CVSS vector scores the precondition as `PR:L/UI:R` — an "authorized attacker" with some user interaction ([Microsoft Security Response Center, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911)) — but Franky's Web's technical description, Germany's CERT-Bund and the Dutch NCSC-NL all independently characterise the flaw as exploitable by an attacker with no authentication at all. CERT-Bund states the public exploit "enabl[es] the complete remote takeover of systems without authentication" ([CERT-Bund, 2026-08-28](https://social.bund.de/@certbund/117171896801475447)), and NCSC-NL's own advisory states plainly that the flaw "allows an unauthenticated attacker to execute arbitrary code" ([NCSC-NL, 2026-08-28](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0289)). A third-party technical reconstruction of the exploit chain narrows what "coerce or capture" requires in practice: MB VRED's own most plausible hypothesis — not a confirmed finding — is that the attacker needs an existing foothold on the internal, domain-joined network to issue an MS-EFSR (PetitPotam-style) coercion call against one Exchange server, capturing its machine-account authentication and relaying it to the MRSProxy endpoint on a *different* Exchange server — "The attacker sits inside the network, especially inside a domain-joined PC!" — and the technique needs at least two Exchange servers in the environment, since "the captured hash cannot be relayed to itself." MB VRED frames this as requiring "lot of non-realistic conditions to be exploited in the real world" — specifically, outbound connectivity from an Exchange server and inbound access on ports domain users do not normally reach it on — closing with "So, for the defensive guys, don’t be panic!" ([MB VRED, 2026-08-13](https://vred.mbbank.com.vn/p/analysis-of-exchange-server-pre-auth)). Weighing two independent national CERTs' plain "unauthenticated" characterization against both the vendor's own CVSS labelling and this single, uncorroborated hypothesis about the network position it may actually require, any Exchange server below the August 2026 build should still be patched on the CERTs' own stated urgency — but MB VRED's own caveats are a reason for caution before assuming this is exploitable from the open internet without any existing foothold on the target's network. Detection concept: authentication and session telemetry for MRSProxy/EWS access running under the Exchange server's own machine-account context but originating from unexpected source hosts — a legitimate mailbox move originates internally, not via relayed external traffic — with Windows Security Event 4624 Logon Type 3 network logons in that account context as the platform-specific anchor. **Defender takeaway:** confirm every Exchange server is on the August 2026 build before this PoC turns into observed exploitation; there is no interim mitigation to fall back on. ## Update — 2026-09-01T04:40:00Z Following a press inquiry, Germany's CERT-Bund (part of the BSI) disclosed on 2026-08-28 that most of the country's on-premises Exchange population had still not applied the August patch: *"Currently, however, around 85% of on-premises Exchange servers in Germany are still vulnerable to this vulnerability" (translated from German)* ([CERT-Bund, 2026-08-28](https://social.bund.de/@certbund/117171896801475447)). BSI states it has been proactively notifying German network operators about still-vulnerable systems in their networks since 2026-08-14 ([heise Security, 2026-08-31](https://www.heise.de/news/Exchange-Sicherheitsluecke-85-Prozent-der-On-Prem-Server-in-Deutschland-anfaellig-11434785.html)). For the small population of Exchange 2016/2019 installs still supported only through the paid Extended Security Updates program, BSI says it is aware of only nine servers in Germany with the ESU patch installed ([BSI, via heise Security, 2026-08-31](https://www.heise.de/news/Exchange-Sicherheitsluecke-85-Prozent-der-On-Prem-Server-in-Deutschland-anfaellig-11434785.html)). BSI's standing advice is unchanged: restrict internet-facing access to an Exchange server's web-based services to trusted source IP ranges, or place it behind a VPN. **This is the operationally important delta for any DACH-region on-prem Exchange operator, including Swiss cantonal and communal administrations running Exchange on-premises:** German telemetry indicates that most operators in a comparable environment have not applied a two-week-old patch against a pre-auth, mailbox-wide takeover chain with public exploit code. "We applied the August patch" should be verified against the actual installed build number, not assumed from a routine patch-cycle checklist.