The disclosure of CVE-2026-62911, an authentication bypass vulnerability in Microsoft Exchange Server, has introduced a significant risk of commoditized exploit chains. While active exploitation has not been confirmed as of September 1, the availability of functional proof-of-concept code and a significant number of unpatched, internet-facing servers create a high-risk environment for enterprise IT.
The vulnerability carries a CVSS score of 8.0 from Microsoft and 8.1 from the Zero Day Initiative. It stems from a flaw in how Exchange handles authentication through an architectural discrepancy between two paths used by the Mailbox Replication Service (MRSProxy). The path /EWS/MRSProxy.svc is hosted by IIS and protected by Extended Protection for Authentication (EPA), rendering it secure. The path /Microsoft.Exchange.MailboxReplicationService.ProxyService is hosted by HTTP.sys and lacks EPA enforcement, providing a vulnerable target for NTLM relay attacks.
An attacker can coerce Exchange machine account authentication using techniques like PetitPotam (MS-EFSR) and relay that NTLM authentication to the HTTP.sys endpoint. By abusing Windows Communication Foundation (WCF) methods—specifically IMailbox_Config6 with an attacker-controlled file path and IMailbox_Connect—an adversary can write an ASPX webshell into an IIS directory, ultimately achieving SYSTEM-level code execution. This three-bug chain was originally demonstrated by Orange Tsai of the DEVCORE Research Team at Pwn2Own Berlin 2026, where it earned a $200,000 prize and 20 Master of Pwn points.
A public PoC exploit is available on GitHub with 160 stars and 27 forks, featuring a full Python script that simplifies the attack flow. The Netherlands National Cyber Security Centre (NCSC-NL) confirmed exploit code availability on August 28 and characterized it as “laagdrempelig”—low-effort and easy to weaponize—for unauthenticated remote code execution against unpatched servers.
Shadowserver Foundation data as of August 31 indicates 21,899 unique internet-facing IP addresses remain vulnerable, according to BleepingComputer. The geographic distribution is concentrated: approximately 6,200 vulnerable servers in the United States, 5,100 in Germany, and several hundred each in the United Kingdom, Russia, Canada, Austria, and France. Germany’s Federal Office for Information Security (BSI) reported that roughly 85% of on-premises Exchange servers in the country were still unpatched as of September 1, according to CyberSecurityNews.
Microsoft addressed the vulnerability in the August 2026 Patch Tuesday release: KB5121573 for Subscription Edition RTM, KB5121574 for 2019 CU15, KB5121575 for 2019 CU14, and KB5121576 for 2016 CU23. Organizations running Exchange 2016 face a critical deadline: the product reached end-of-life in October 2025, and security updates are only available through the Extended Security Updates (ESU) program, which concludes in October 2026. Those without ESU coverage have no official patch path.
Despite the severity of the attack chain, Microsoft has rated the likelihood of exploitation as “Less Likely,” and CISA currently lists exploitation as “none.” The ZDI has publicly disputed Microsoft’s “unproven” exploit-maturity rating. The combination of a demonstrated SYSTEM-level attack chain, readily available exploit code, and thousands of exposed servers creates a narrowing window—regardless of whether active exploitation has begun.