Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

PT - exchange (smb_nt_ms26_aug_exchange.nasl)

The remote Microsoft Exchange Server exposes the Mailbox Replication Service Proxy (MRSProxy) WCF endpoint without Extended Protection for Authentication (EPA) enforcement. The endpoint at /Microsoft.Exchange.MailboxReplicationService.ProxyService is hosted directly by HTTP.sys and accepts NTLM authentication without requiring channel binding tokens.

An unauthenticated attacker who can reach two Exchange servers on the network can exploit this by:

  1. Using PetitPotam (MS-EFSR, unauthenticated) to coerce Exchange      server B into authenticating to the attacker's relay listener.

  2. Relaying the captured machine account NTLM hash from SMB to the      MRSProxy HTTPS endpoint on Exchange server A. Because EPA is not      enforced, the relay succeeds despite the cross-protocol change.

  3. Machine accounts hold the ms-Exch-EPI-Token-Serialization right,      granting full MRSProxy access once authenticated.

  4. Calling IMailbox_Config6 with an attacker-controlled file path.
     PstDestinationMailbox.ConfigPst() performs no extension validation,      allowing a .aspx webshell path.

  5. Calling IMailbox_Connect, which triggers PSTSession.Open() and      writes the file to disk, yielding SYSTEM-level RCE.

Nessus verified that the MRSProxy endpoint is reachable, offers NTLM authentication, and does NOT enforce channel binding (EPA) in the NTLM Type 2 challenge, which is the condition that enables the relay attack.

Note: This check does NOT write any file to the target, does NOT relay or transmit credentials, and does NOT establish an authenticated session. It performs only an unauthenticated NTLM handshake probe.

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an     authorized attacker to elevate privileges over a network. (CVE-2026-62910)

  - Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to     elevate privileges over a network. (CVE-2026-62911)

  - Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over     a network. (CVE-2026-62913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
342664	Microsoft Exchange Server MRSProxy Pre-Auth NTLM Relay RCE (CVE-2026-62911)	Nessus	Windows	Remote	high
334612	Security Updates for Microsoft Exchange Server (August 2026)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2026-62911

high

Tenable Plugins

Coming Soon

high

high