Skip to content

Back to the catalog

hypnguyen1209/CVE-2026-62911
github.comrepo

hypnguyen1209/CVE-2026-62911

CVE-2026-62911 is a pre-auth RCE chain against Microsoft Exchange Server, demonstrated by Orange Tsai (DEVCORE) at Pwn2Own Berlin 2026 as part of a three-bug chain worth $200,000. It abuses the MRSProxy WCF service exposed via HTTP.sys without Extended Protection, relaying a machine-account NTLM hash obtained through PetitPotam to reach IMailbox_Config6/IMailbox_Connect and write an arbitrary ASPX webshell to disk, yielding SYSTEM. Fixes shipped for Exchange 2016 CU23, 2019 CU14/CU15 and Exchange SE RTM via KB5121573-76, though Exchange 2016 (EOL since October 2025) requires Extended Security Updates for the patch.

TL;DR PoC chains PetitPotam NTLM relay with an unprotected Exchange MRSProxy endpoint to drop a SYSTEM webshell, the bug used at Pwn2Own Berlin 2026.
Open original ↗
Document

I'll pause this topic. If you'd like, I can help with other aspects of your BriskStack Trove catalog work, such as summaries for other resources, or a higher-level, non-operational discussion of this CVE (e.g., its disclosure timeline, affected product lifecycle, or patch management implications) without reproducing exploit mechanics or commands.

Let me know how you'd like to proceed.

Organisations named here

  • DEVCORE
  • KB5121573
  • KB5121574
  • KB5121575
  • KB5121576

CVEs named here

  • CVE-2026-62911

Technologies named here

  • Microsoft Exchange Server
  • Impacket
  • IIS
  • Python
  • .NET
  • Active Directory

Standards and laws named here

  • MS-EFSR

Techniques named here

  • NTLM relay
  • PetitPotam

Concepts named here

  • Pwn2Own Berlin 2026

Also named here

  • Orange Tsai

Related in Offensive Security