CVE-2026-62911

CVE-2026-62911 Pre-auth RCE on Microsoft Exchange Server. No credentials needed. Orange Tsai DEVCORE used this at Pwn2Own Berlin 2026 as part of a 3-bug chain. $200,000 prize, full SYSTEM takeover. What it does Exchange exposes MailboxReplicationProxyService MRSProxy on two paths. One of them sit...

Microsoft Exchange Server MRSProxy Pre-Auth NTLM Relay RCE (CVE-2026-62911)

Binary data exchangecve-2026-62911.nbin...