CVE-2026-62911 Enables Pre-Auth RCE on Exchange Server

Summary

A critical pre-authentication remote code execution vulnerability affects Microsoft Exchange Server because Extended Protection is not enforced on the MRSProxy HTTP.sys endpoint. Attackers can exploit the flaw through a PetitPotam-style NTLM relay to obtain machine account privileges. This access can then be abused through WCF service methods to write arbitrary files, including ASPX webshells, to disk and ultimately achieve SYSTEM-level control.

Investigation

Orange Tsai demonstrated the vulnerability at Pwn2Own Berlin 2026 as part of a three-bug exploit chain. The investigation showed that the HTTP.sys endpoint accepts Negotiate authentication but does not properly validate channel bindings. This weakness enables attackers to relay machine account hashes and gain authorized access to the MailboxReplicationProxyService.

Mitigation

Organizations should apply the appropriate Microsoft security update, including KB5121576, KB5121575, KB5121574, or KB5121573, depending on the deployed Exchange version. Exchange 2016 reached end-of-life in October 2025 and requires Extended Security Updates (ESU) for continued protection. Enabling Extended Protection across Exchange services remains the primary technical mitigation.

Response

If unauthorized file creation in IIS directories or unusual WCF service activity is detected, administrators should isolate the affected Exchange server immediately. Security teams should review logs for NTLM relay attempts targeting the MRSProxy endpoint and monitor suspicious ASPX execution under the NT AUTHORITY\SYSTEM context. The integrity of MSExchangeMailboxReplication.exe.config should also be verified.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary identifies an Exchange Server and intends to exploit CVE-2026-62911 by relaying an intercepted NTLM authentication session to the MRSProxy endpoint. By forcing the victim to authenticate against the MRSProxy service via HTTP, the adversary triggers a successful network logon event. This specific interaction causes the Windows Security subsystem to log an Event ID 4624 with LogonType 3 and identifies the target service context within the DetailedAuthenticationInformation field, which is the specific trigger for the detection rule.

• Regression Test Script:

  <#
  .SYNOPSIS
  Simulates a successful NTLM relay to the MRSProxy endpoint to trigger CVE-2026-62911 detection.
  NOTE: This script simulates the LOGON event generation locally for validation purposes.
  #>
  
  Write-Host "[+] Starting Simulation: CVE-2026-62911 Relay Attempt" -ForegroundColor Cyan
  
  # In a real attack, this would be triggered by an external tool like Impacket or Responder
  # For detection validation, we simulate the resulting Security Event 4624 log entry.
  
  $EventLogEntry = @{
      EventID = 4624
      LogonType = 3
      AuthenticationPackageName = "Negotiate"
      DetailedAuthenticationInformation = "MRSProxy"
      TargetUserName = "RelayedUser"
      IpAddress = "192.168.1.50"
  }
  
  Write-Host "[+] Generating Simulated Security Event 4624..." -ForegroundColor Yellow
  
  # Since we cannot easily 'fake' a kernel-level security event without Admin/System privileges,
  # we use this block to represent the telemetry that SHOULD appear in the SIEM.
  # To test the actual SIEM rule, use a tool like 'Invoke-Mimikatz' or 'impacket-ntlmrelayx' 
  # against a lab Exchange server.
  
  Write-Host "[!] Simulation Telemetry Data Payload:" -ForegroundColor White
  $EventLogEntry | Out-String | Write-Host
  
  Write-Host "[+] Simulation Complete. Check SIEM for EventID 4624 with MRSProxy context." -ForegroundColor Green

• Cleanup Commands:

  # No persistent changes are made by the simulation script.
  # If manual drives were mapped during pre-flight, remove them:
  Get-PSDrive -Name "TestDrive" -ErrorAction SilentlyContinue | Remove-PSDrive
  Write-Host "[+] Cleanup Complete." -ForegroundColor Green