A critical pre-authentication remote code execution vulnerability affects Microsoft Exchange Server because Extended Protection is not enforced on the MRSProxy HTTP.sys endpoint. Attackers can exploit the flaw through a PetitPotam-style NTLM relay to obtain machine account privileges. This access can then be abused through WCF service methods to write arbitrary files, including ASPX webshells, to disk and ultimately achieve SYSTEM-level control.
Orange Tsai demonstrated the vulnerability at Pwn2Own Berlin 2026 as part of a three-bug exploit chain. The investigation showed that the HTTP.sys endpoint accepts Negotiate authentication but does not properly validate channel bindings. This weakness enables attackers to relay machine account hashes and gain authorized access to the MailboxReplicationProxyService .
Organizations should apply the appropriate Microsoft security update, including KB5121576, KB5121575, KB5121574, or KB5121573, depending on the deployed Exchange version. Exchange 2016 reached end-of-life in October 2025 and requires Extended Security Updates (ESU) for continued protection. Enabling Extended Protection across Exchange services remains the primary technical mitigation.
If unauthorized file creation in IIS directories or unusual WCF service activity is detected, administrators should isolate the affected Exchange server immediately. Security teams should review logs for NTLM relay attempts targeting the MRSProxy endpoint and monitor suspicious ASPX execution under the NT AUTHORITY\SYSTEM context. The integrity of MSExchangeMailboxReplication.exe.config should also be verified.
## Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary identifies an Exchange Server and intends to exploit CVE-2026-62911 by relaying an intercepted NTLM authentication session to the MRSProxy endpoint. By forcing the victim to authenticate against the MRSProxy service via HTTP, the adversary triggers a successful network logon event. This specific interaction causes the Windows Security subsystem to log an Event ID 4624 with LogonType 3 and identifies the target service context within the DetailedAuthenticationInformation field, which is the specific trigger for the detection rule.
Attack Narrative & Commands: The adversary identifies an Exchange Server and intends to exploit CVE-2026-62911 by relaying an intercepted NTLM authentication session to the MRSProxy endpoint. By forcing the victim to authenticate against the MRSProxy service via HTTP, the adversary triggers a successful network logon event. This specific interaction causes the Windows Security subsystem to log an Event ID 4624 with LogonType 3 and identifies the target service context within the DetailedAuthenticationInformation field, which is the specific trigger for the detection rule.
Regression Test Script: Write-Host "[+] Starting Simulation: CVE-2026-62911 Relay Attempt" -ForegroundColor Cyan # In a real attack, this would be triggered by an external tool like Impacket or Responder # For detection validation, we simulate the resulting Security Event 4624 log entry. $EventLogEntry = @{ EventID = 4624 LogonType = 3 AuthenticationPackageName = "Negotiate" DetailedAuthenticationInformation = "MRSProxy" TargetUserName = "RelayedUser" IpAddress = "192.168.1.50" } Write-Host "[+] Generating Simulated Security Event 4624..." -ForegroundColor Yellow # Since we cannot easily 'fake' a kernel-level security event without Admin/System privileges, # we use this block to represent the telemetry that SHOULD appear in the SIEM. # To test the actual SIEM rule, use a tool like 'Invoke-Mimikatz' or 'impacket-ntlmrelayx' # against a lab Exchange server. Write-Host "[!] Simulation Telemetry Data Payload:" -ForegroundColor White $EventLogEntry | Out-String | Write-Host Write-Host "[+] Simulation Complete. Check SIEM for EventID 4624 with MRSProxy context." -ForegroundColor Green
Regression Test Script:
Cleanup Commands: # No persistent changes are made by the simulation script. # If manual drives were mapped during pre-flight, remove them: Get-PSDrive -Name "TestDrive" -ErrorAction SilentlyContinue | Remove-PSDrive Write-Host "[+] Cleanup Complete." -ForegroundColor Green
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
