Loading vulnerability…
CVE-2026-62911 is a CWE-294 authentication-bypass-by-capture-replay vulnerability in on-premises Microsoft Exchange Server. The issue affects MRSProxy functionality exposed through HTTP.sys, where Negotiate authentication reportedly lacks Extended Protection for Authentication channel-binding validation. This can permit relaying captured NTLM authentication, including an Exchange server computer account, to the affected endpoint and having that identity treated as a trusted Exchange server. Microsoft classifies the vulnerability as network-based elevation of privilege. Public research further describes chaining the bypass with a separate mailbox-replication file-path validation weakness to perform arbitrary file writes and obtain code execution; that chained outcome is beyond the standalone CVE's official elevation-of-privilege description.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains two files: a README describing the vulnerability and attack chain, and a single Python exploit entry point, exploit.py. The code is a standalone operational exploit for CVE-2026-62911 targeting Microsoft Exchange Server. Its purpose is to achieve pre-authentication SYSTEM-level RCE by chaining NTLM coercion and NTLM relay into the Exchange MailboxReplicationProxyService (MRSProxy), then abusing a file write primitive to drop an ASPX webshell. The exploit structure, based on the visible code and README, includes: (1) argument parsing and main orchestration logic; (2) a PetitPotam/MS-EFSR coercion routine using the MS-EFSR RPC interface over the lsarpc named pipe to force a remote Exchange server to authenticate to the attacker-controlled SMB listener; (3) an NTLM relay component that listens on SMB/445, captures the machine account authentication, and relays it to the target Exchange HTTPS MRSProxy endpoint; (4) WCF/MRSProxy interaction that invokes IMailbox_Config6 with an attacker-controlled file path and then IMailbox_Connect to cause the target to write the supplied ASPX webshell to disk; and (5) verification logic that accesses the resulting webshell URL and executes commands via a cmd parameter. Main exploit capabilities: coercing machine-account NTLM authentication from a trigger Exchange host, relaying that authentication to a second Exchange host, abusing missing Extended Protection on the HTTP.sys-hosted MRSProxy endpoint, writing arbitrary files to attacker-chosen paths under IIS/Exchange web directories, and obtaining remote command execution through an ASPX webshell. The exploit also supports check-only and verify-only workflows, optional authenticated coercion if unauthenticated PetitPotam is unavailable, and optional SOCKS5 proxying. Fingerprintable targets and artifacts include the vulnerable MRSProxy path /Microsoft.Exchange.MailboxReplicationService.ProxyService, the comparison path /EWS/MRSProxy.svc, the MS-EFSR RPC interface UUID c681d488-d850-11d0-8c52-00c04fd90f7e, the lsarpc named pipe binding, SMB listener port 445, and several hardcoded or documented IIS/Exchange file paths and URLs for webshell placement such as C:\inetpub\wwwroot\aspnet_client\system_web\shell.aspx and /aspnet_client/system_web/shell.aspx. Overall, this is not merely a detector or README-only repository; it is a real exploit implementation with a concrete payload delivery mechanism and post-exploitation access path. The payload is basic and hardcoded around an ASPX webshell deployment rather than a modular framework payload, so OPERATIONAL is the best maturity fit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
95 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical authenticated remote privilege-escalation vulnerability in Microsoft Exchange that could enable compromise of all user mailboxes on an affected Exchange server, including reading and sending email and downloading attachments.
A critical Microsoft Exchange Server capture-replay authentication-bypass flaw that enables an authorized network attacker to elevate privileges. Approximately 22,000 servers were reported unpatched, and NCSC-NL reported that a working exploit was circulating online.
High-severity Microsoft Exchange Server authentication-bypass flaw (CVSS 8.0) affecting an MRSProxy endpoint served by HTTP.sys. Missing validation of NTLM channel bindings permits NTLM relay of an Exchange server computer account, allowing authentication to be bypassed and privileges escalated. The article states this can be chained with a separate mailbox-replication path-validation weakness to write a web-accessible ASPX file and obtain remote code execution as NT AUTHORITY\SYSTEM, including access to server mailboxes.
A high-severity capture-replay authentication-bypass and privilege-escalation vulnerability in Microsoft Exchange Server that can let an attacker with basic authorized access hijack all user mailboxes, including reading email, sending messages, and downloading attachments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.