Beyond the CVSS Score: Why Microsoft’s 8.0 Rating Understates the Risk

Executive Summary

A critical security vulnerability affecting Microsoft Exchange has been reported to impact 21 899 internet-facing Microsoft Exchange servers. Attackers could exploit this vulnerability to gain remote code execution with SYSTEM privileges on compromised Exchange servers due to authentication bypass. Microsoft released patches on August 11, 2026, but still, thousands of organizations are still at risk. Moreover, public proof-of-concept exploit code is now available.

Technical Analysis

Description of the Vulnerability

The vulnerability exists in the way Microsoft Exchange handles the authentication of Mailbox Replication Proxy Service. The problem occurs because of the lack of the Extended Protection for Authentication check on one of the endpoints that is used to relay connections to MRSProxy.

Microsoft Exchange MRSProxy service is exposed via two endpoints. The first one is the IIS hosted endpoint at /EWS/MRSProxy.svc, which correctly implements the Extended Protection for Authentication and channel binding validation. The second one is the HTTP/sys hosted endpoint at /Microsoft.Exchange.MailboxReplicationService.ProxyService , which accepts Negotiate authentication without channel binding validation.

The MRSProxy service's configuration file (MSExchangeMailboxReplication.exe.config) defines the binding for the HTTP/sys endpoint as the following:

<! — no extendedProtectionPolicy — this is the vulnerability →

Attack Chain Overview

The following attack chain demonstrates how the vulnerability could be weaponized to achieve Remote Code Execution on a targeted Exchange server:

1. Machine account coercion: The attacker uses a coercion technique to get any machine account to authenticate to the attacker-controlled listener.

2. NTLM relay: The NTLM authentication hash is relayed to the target Exchange server using the vulnerable HTTP/sys endpoint.

3. Authentication bypass: Since there is no Extended Protection for Authentication check, Exchange server accepts the authentication request and relays it to the MRSProxy service. MRSProxy service does not validate channel bindings, thus, the authentication of the machine account is successful. The machine account has ms-Exch-EPI-Token-Serialization permissions by default, thus, the attacker gets full access to WCF service.

4. Arbitrary file write: The attacker uses the IMailbox_Config6() COM interface to write a file with a specified file path. The vulnerability does not sanitize the file extension, thus, the attacker could write a webshell to the IIS directory by specifying the path to it. Then, the attacker uses the IMailbox_Connect() COM interface to inject an ASPX webshell into the IIS directory.

5. Remote Code Execution: The webshell is executed with the privileges of the Exchange service account, thus, giving the attacker SYSTEM-level access to the compromised Exchange server.

The aforementioned attack was demonstrated at the Pwn2Own Berlin 2026 competition by the independent security researcher Orange Tsai of DEVCORE and awarded with $200,000.

Affected Software and Patch Status

The Vulnerability affects all on-premises Exchange Server versions:

— Exchange Server 2016 Cumulative Update 23 (build lower than 15.1.2507.72)

— Exchange Server 2019 Cumulative Update 14 (build lower than 15.2.1544.43)

— Exchange Server 2019 Cumulative Update 15 (build lower than 15.2.1748.48)

— Exchange Server Subscription Edition RTM (build lower than 15.2.2562.45)

Microsoft released the following security updates on August 11, 2026, to address the vulnerability:

— KB5121576 — Exchange Server 2016 CU23

— KB5121575 — Exchange Server 2019 CU14

— KB5121574 — Exchange Server 2019 CU15

— KB5121573 — Exchange Server Subscription Edition

It is important to note that Exchange Server 2016 reached End of Life on October 13, 2025. Therefore, extended support for Exchange Server 2016 is available through Extended Security Updates (ESU) for customers with active subscriptions.

Current Exposure

The number of Internet-facing Exchange servers exposed to the vulnerability is 21 899 as of August 31, 2026, according to Shadowserver Foundation scans.

Approximately 6,200 vulnerable Exchange servers are located in the United States and approximately 5,100 vulnerable Exchange servers are located in Germany. According to the German Federal Office for Information Security (BSI), approximately 85 percent of all on-premises Exchange servers in Germany are vulnerable to CVE-2026–62911.

Risk Assessment

The following factors increase the risk of this vulnerability:

The proof-of-concept exploit code for this vulnerability is publicly available . In particular, a Github account of the Vietnamese security researcher Hiep Van Nguyen contains a PoC, which demonstrates the ability to perform pre-authentication remote code execution against Exchange 2019.

In addition, Microsoft's initial vulnerability severity assessment is misleading in terms of potential attack vectors. According to Microsoft, CVE-2026–62911 is an elevation-of-privilege vulnerability with a CVSS score of 8.0. Microsoft notes that to exploit the vulnerability, the attacker would need to establish an authenticated remote connection with Exchange Server. However, the proof-of-concept exploit demonstrates that no authentication is required to achieve remote code execution. On the contrary, the attacker merely needs to coerce the machine account of the target Exchange Server.

Moreover, Microsoft Exchange continues to be a primary target for ransomware actors and nation-state level threat groups. In particular, since January 2021, CISA has added 20 Microsoft Exchange Server vulnerabilities to the catalog of Known Exploited Vulnerabilities. In particular, 14 of these vulnerabilities were actively used by ransomware gangs.

Detection and Response

SIEM Rules

— SIEM rules should be configured to detect suspicious activity related to WCF services, including:

— Event ID 4624 with LogonType 3 and MRSProxy information in the Details of the Event Viewer.

— Suspicious WCF requests to MailboxReplicationProxyService.

— Unexpected creation or modification of ASPX files.

— ASP pages execution with SYSTEM context.

— Integrity changes to MSExchangeMailboxReplication.exe.config file.

Response Procedures

— Isolate the compromised Exchange server.

— Check the system logs for NTLM relay attempts.

— Scan IIS directory for ASPX web shells.

— Verify if MSExchangeMailboxReplication.exe.config file integrity has been compromised.

— Ensure that the security update has been installed if the organization is compromised.

Remediation Recommendations

The following mitigation measures are recommended:

Apply security updates: The most critical step is to apply the latest Exchange Server security update released on August 11, 2026. For organizations running Exchange Server 2016, it is essential to have Active Extended Security Updates (ESU) subscription since Microsoft stopped providing free security updates for this product as of October 2025.

Verify Extended Protection for Authentication: Microsoft recommends verifying the Extended Protection for Authentication configuration for all Exchange endpoints. The configuration change made by the security update is not sufficient to protect Exchange servers from NTLM relay attacks. As such, it is recommended to configure Extended Protection for Authentication to help prevent NTLM relay attacks.

Network security: Only trusted networks should be allowed to access Exchange services. It is recommended to implement a VPN or IP allowlisting for remote Exchange administrator access.

Migration to Exchange Server Subscription Edition : It is recommended to migrate to Exchange Server Subscription Edition, as Microsoft will provide support for this product until January 2027.

Versions and Builds

— Exchange Server 2016 CU23 — build 15.1.2507.72 or higher

— Exchange Server 2019 CU14 — build 15.2.1544.43 or higher

— Exchange Server 2019 CU15 — build 15.2.1748.48 or higher

— Exchange Server Subscription Edition RTM — build 15.2.2562.45 or higher

Conclusion

CVE-2026–62911 is a critical vulnerability affecting all Microsoft Exchange Server products. Given that proof-of-concept exploit code is publicly available and many organizations have not applied the required security updates, there is a high likelihood that this vulnerability will be actively weaponized by malicious threat actors. As such, the organizations with unpatched Exchange servers should consider implementing the recommended response procedures. In particular, the organizations running Exchange Server 2016 without Extended Security Updates (ESU) subscription should either subscribe to ESU or migrate to Exchange Server Subscription Edition as soon as possible.

Moreover, the vulnerability once again demonstrated the importance of the NTLM relay protection and proper Extended Protection for Authentication configuration. Organizations that have not yet applied the necessary configuration changes to protect their Exchange services from NTLM relay attacks should do so without further ado. In particular, it is crucial to protect all Exchange-related endpoints, including EWS and MRSProxy, with Extended Protection for Authentication to defend against NTLM relay attacks.