Detections
Analytics

Microsoft Exchange Server MRSProxy Pre-Auth NTLM Relay RCE (CVE-2026-62911)

high Nessus Plugin ID 342664

Synopsis

The remote Microsoft Exchange Server is vulnerable to a pre-authentication remote code execution attack via NTLM relay.

Description

The remote Microsoft Exchange Server exposes the Mailbox Replication Service Proxy (MRSProxy) WCF endpoint without Extended Protection for Authentication (EPA) enforcement. The endpoint at /Microsoft.Exchange.MailboxReplicationService.ProxyService is hosted directly by HTTP.sys and accepts NTLM authentication without requiring channel binding tokens.

An unauthenticated attacker who can reach two Exchange servers on the network can exploit this by:

 1. Using PetitPotam (MS-EFSR, unauthenticated) to coerce Exchange server B into authenticating to the attacker's relay listener.

 2. Relaying the captured machine account NTLM hash from SMB to the MRSProxy HTTPS endpoint on Exchange server A. Because EPA is not enforced, the relay succeeds despite the cross-protocol change.

 3. Machine accounts hold the ms-Exch-EPI-Token-Serialization right, granting full MRSProxy access once authenticated.

 4. Calling IMailbox_Config6 with an attacker-controlled file path.
 PstDestinationMailbox.ConfigPst() performs no extension validation, allowing a .aspx webshell path.

 5. Calling IMailbox_Connect, which triggers PSTSession.Open() and writes the file to disk, yielding SYSTEM-level RCE.

Nessus verified that the MRSProxy endpoint is reachable, offers NTLM authentication, and does NOT enforce channel binding (EPA) in the NTLM Type 2 challenge, which is the condition that enables the relay attack.

Note: This check does NOT write any file to the target, does NOT relay or transmit credentials, and does NOT establish an authenticated session. It performs only an unauthenticated NTLM handshake probe.

Solution

Apply the August 2026 Microsoft Exchange Server cumulative update.

See Also

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911

Plugin Details

Severity: High

ID: 342664

File Name: exchange_cve-2026-62911.nbin

Version: 1.2

Type: Remote

Agent: windows

Family: Windows

Published: 9/3/2026

Updated: 9/4/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-62911

CVSS v3

Risk Factor: High

Base Score: 8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:microsoft:exchange_server

Required KB Items: installed_sw/Exchange Server

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/8/2026

Vulnerability Publication Date: 5/15/2026

Reference Information

CVE: CVE-2026-62911