What is the CVSS score of CVE-2026-62911?

CVE-2026-62911 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-62911?

Microsoft Exchange Server 2016, 2019, and Subscription Edition contain an authentication bypass vulnerability (CVE-2026-62911, CVSS 8.0) that allows low-privilege network users with mailbox access to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-62911?

Yes, a public proof-of-concept exploit is available for CVE-2026-62911. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-62911?

Within 24 hours, inventory all Exchange Server deployments to identify affected versions (2016, 2019, Subscription Edition) and document their cumulative update levels. Within 7 days, apply Microsoft-released patches to all identified Exchange servers across all affected cumulative update tracks; coordinate with email operations to schedule maintenance windows with minimal business disruption. Within 30 days, verify patch deployment across all Exchange infrastructure through Microsoft patching attestation tools and log review, and conduct access reviews to identify any suspicious token usage or privilege escalations during the vulnerability window.

Microsoft Exchange Server CVE-2026-62911

EUVD-2026-56688 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-08-11 secure@microsoft.com

GHSA-hjp7-hfwh-7664

Authentication Bypass Microsoft Exchange Server Exchange Server Subscription Edition

8.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.1 HIGH

Capture-replay requires active network interception positioning (AC:H); attacker needs existing low-privilege account (PR:L) and victim authentication event (UI:R).

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:56 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.0

DescriptionCVE.org

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Articles & Coverage 1

POC CVE-2026-62911: Pre-Auth RCE on Microsoft Exchange via NTLM Relay to MRSProxy HTTP.sys Endpoint Aug 22, 2026

AnalysisAI

Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks.

Technical ContextAI

CWE-294 (Authentication Bypass by Capture-Replay) describes a class of flaws where a network authentication mechanism fails to include session-unique or time-bound nonces, allowing an attacker who can observe authentication traffic to replay captured credentials or tokens against the same service. In Exchange Server's context, this likely involves a protocol-level weakness in how Exchange handles authentication tokens over the network - possibly NTLM relay or a similar challenge-response mechanism susceptible to replay without requiring the original credential material. Affected CPE targets include Exchange Server 2016 CU23 (versions below 15.01.2507.072), Exchange Server 2019 CU14 (below 15.02.1544.044), Exchange Server 2019 CU15 (below 15.02.1748.049), and Exchange Server Subscription Edition RTM (below 15.02.2562.046).

RemediationAI

Apply the vendor-released patches immediately: upgrade Exchange Server 2019 CU15 to build 15.02.1748.049 or later, Exchange Server 2019 CU14 to 15.02.1544.044 or later, Exchange Server 2016 CU23 to 15.01.2507.072 or later, and Exchange Server Subscription Edition RTM to 15.02.2562.046 or later. Full patch details are published in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911. If immediate patching is not possible, consider restricting internal network access to Exchange endpoints to only trusted VLANs or segments to reduce the attacker's ability to intercept authentication traffic - note this has operational impact for mobile and remote users relying on direct connectivity. Enabling SMB signing and LDAP signing across the domain (if NTLM relay is the underlying mechanism) can serve as a compensating control; however, enabling these in environments with legacy clients may cause authentication failures. Enforcing Kerberos over NTLM wherever supported within Exchange can further reduce replay surface, though this requires validation of all client compatibility before deployment.