Vulnerability in Microsoft Exchange Server
CVE-2026-62911
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.007, 53.3th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- Microsoft Exchange Server — versions 2016, 2019
- Microsoft Exchange Server Subscription Edition
- Microsoft Exchange Server 2016 Cumulative Update 23 — versions 15.01.0.0
- Microsoft Exchange Server 2019 Cumulative Update 14 — versions 15.02.0.0
- Microsoft Exchange Server 2019 Cumulative Update 15 — versions 15.02.0.0
- Microsoft Exchange Server Subscription Edition Rtm — versions 15.02.0.0
Weakness classification (CWE)
Public exploits and proof-of-concept code
5 public repositories with exploit or proof-of-concept code for this CVE:
- hypnguyen1209/CVE-2026-62911 (194 stars, last pushed 2026-08-22): POC pre-auth RCE on Exchange
- ZeroDayEvil/CVE-2026-62911 (23 stars, last pushed 2026-09-28)
- c5z54/cve-2026-62911-poc (3 stars, last pushed 2026-11-02): CVE-2026-62911 — Exchange MRSProxy Pre-Auth RCE PoC | Scanner + Exploit | NTLM Relay → Webshell → SYSTEM
- che3axujnya/cve-2026-62911 (1 star, last pushed 2026-10-20): cve-2026-62911-exploit
- fahise/cve-2026-62911 (1 star, last pushed 2026-10-20): cve-2026-62911-exploit
References
- Microsoft Exchange Server Elevation of Privilege Vulnerability (vendor-advisory, Patch, patch, Vendor Advisory)
- github.com/hypnguyen1209/CVE-2026-62911
This CVE has public exploit evidence. See the latest CVEs with public exploits.