Exchange Authentication Bypass Vulnerability Now Exploitable

A working exploit for an Exchange authentication bypass vulnerability is now public on GitHub, and heise.de reports that roughly 85% of on-premises Exchange servers in Germany remain vulnerable three weeks after Microsoft shipped a fix. The catch: for organizations still running Exchange 2016 or 2019, that fix is locked behind Microsoft’s paid Extended Security Update program — Exchange Server Subscription Edition customers get the same fix through the normal update channel, no extra contract required.

What Happened

The technical name for this Exchange authentication bypass vulnerability is CVE-2026-62911 — an authentication bypass via capture-replay (CWE-294), rated CVSS 8.0. It was discovered by Orange Tsai of DEVCORE and, per the researcher’s own Pwn2Own Berlin 2026 write-up, formed one leg of a three-vulnerability chain that won $200,000 for achieving full, unauthenticated SYSTEM-level compromise of an Exchange server — the other two chain components are distinct vulnerabilities in their own right, patched in the same update. The flaw sits in Exchange’s MailboxReplicationProxyService (MRSProxy), which handles Negotiate authentication over an HTTP.sys endpoint; per researcher analysis of the exploit chain, insufficient validation there lets an attacker who has captured a machine account’s authentication material on the network replay it, with Exchange treating the replay as coming from that trusted machine and escalating privileges via ms-Exch-EPI-Token-Serialization. Chained with the other two vulnerabilities, the full chain drops a web shell and hands an attacker complete control of the server.

Microsoft patched all four related issues in the August 11, 2026 Patch Tuesday release, affecting Exchange Server 2016 CU23, Exchange Server 2019 CU14/CU15, and Exchange Server Subscription Edition RTM (x64). The complication is specific to the two out-of-support versions: Exchange Server 2016 reached end-of-life in October 2025, so the August fix for 2016 and 2019 ships only to customers enrolled in Microsoft’s Period 2 Extended Security Update (ESU) program. Exchange Server Subscription Edition is not subject to this restriction and receives its update (KB5121573) through the standard channel regardless of support contract. Organizations running Exchange 2016 or 2019 without an active ESU contract have, as of this writing, no update available for those versions — paid or otherwise. Around August 29–30, working exploit code for the CVE-2026-62911 component appeared publicly on GitHub, and Austria’s CERT.at issued its own advisory flagging the release. Microsoft still rates exploit maturity as “unproven,” and no confirmed in-the-wild exploitation has been reported; security teams should treat public exploit code as a likely accelerant for opportunistic scanning even without a confirmed active-exploitation report yet.

Why It Matters

The German exposure numbers make this more than a theoretical risk: heise.de reports approximately 85% of on-premises Exchange servers in Germany are still vulnerable, citing BSI’s CERT-Bund, which says it has been directly notifying German network operators about exposed systems in their own infrastructure since August 14 — a targeted warning, not a general bulletin. BSI’s own figures make the ESU gap concrete: the agency says it is aware of only nine Exchange 2016/2019 servers in all of Germany that actually have the ESU patch installed. For DACH Mittelstand organizations still running on-prem Exchange for cost or compliance reasons, this converts a routine patch-cycle item into a support-contract audit: NIS2 Article 21 due-diligence obligations do not pause because a vendor gated the fix behind a paid support tier.

What You Should Do Now

1. Check whether your organization is enrolled in Microsoft’s Period 2 Extended Security Update program for Exchange 2016/2019 — this determines whether a patch is even available to you for those versions.
2. If enrolled, apply KB5121574 (Exchange 2019 CU15), KB5121575 (Exchange 2019 CU14) or KB5121576 (Exchange 2016 CU23) immediately. Running Exchange Server Subscription Edition instead? Install KB5121573 — no ESU enrollment needed.
3. If not enrolled and no ESU contract exists for 2016/2019, restrict network exposure to MRSProxy and EWS endpoints now (VPN-only access, IP allow-listing per BSI’s own recommendation) while a migration or ESU purchase is arranged.
4. Monitor for anomalous Negotiate-authentication replay patterns and unexpected file writes into IIS directories on Exchange servers as interim detection until patched.

DIESEC Perspective

This is the second on-premises Exchange incident DIESEC has tracked in three months, after the OWA cross-site-scripting zero-day covered in our May 27 post. The pattern is consistent: Exchange remains one of the most consequential pieces of on-prem infrastructure in DACH environments, and every 2026 incident so far has involved either an incomplete patch, a delayed advisory, or — now — a patch that some customers are contractually barred from receiving.

Not sure whether your Exchange environment still qualifies for security updates under Microsoft’s current support terms? Contact DIESEC for a rapid Exchange support-status and exposure review.

Sources: heise online | Microsoft MSRC
Published: 2026-09-01 | Category: Vulnerabilities & Patches | ~4 min read