CYBUNKR

Exchange Server flaw now has a ready-made exploit tool that ends in a SYSTEM webshell

Published

CVE-2026-62911 in on-premises Microsoft Exchange, fixed in August, has public exploit code, and a scanner-plus-exploit tool appeared on 2 November. Exchange 2016 and 2019 without ESU get no fix. What to check.

If you still run your own Exchange Server, including one kept only for hybrid management, check today that it has the August 2026 security update or later. CVE-2026-62911, which Microsoft rates Critical, lets an attacker on the network elevate privileges (Microsoft). Exploit code has been public since August, and the authors say it ends with a webshell running as SYSTEM, full control of the server (hypnguyen1209).

On 2 November a second tool appeared that adds a scanner, mass scanning from a list of targets and the full exploit chain (c5z54). That lowers the bar from “read the research” to “run the script”.

Who is affected

  • Exchange Server Subscription Edition (SE), 2019 CU14 and CU15, and 2016 CU23 without the August 2026 security update. Fixed builds are 15.2.2562.46 (SE), 15.2.1748.49 (2019 CU15), 15.2.1544.44 (2019 CU14) and 15.1.2507.72 (2016 CU23) (Microsoft).
  • Exchange 2016 and 2019 are out of support. Their August update only went to organisations in Microsoft's paid Period 2 Extended Security Update (ESU) programme (Microsoft), and October 2026 was the last month of new updates for them (Microsoft). Without ESU, there is no fix for these versions.
  • Exchange Online (Microsoft 365) mailboxes are already protected, but any Exchange server you keep on site, even only for management, still needs the update (Microsoft, Microsoft).
  • How the exploit works, according to its authors: it tricks one Exchange server into authenticating to the attacker (PetitPotam), relays that login to a replication service on another Exchange server that does not check Extended Protection, then has that service write an ASPX webshell to disk (hypnguyen1209). The authors say no credentials are needed (hypnguyen1209, c5z54); Microsoft's score assumes a low-privileged attacker and some user interaction (Microsoft).

What has been seen so far

A snapshot from 4 November:

  • At Pwn2Own Berlin in May, Orange Tsai of DEVCORE chained three bugs to run code as SYSTEM on Exchange (Zero Day Initiative). The August exploit's author says this flaw was part of that chain (hypnguyen1209).
  • The first exploit was published on GitHub on 22 August and is linked from the CVE's NVD entry; CISA records its exploitation status as “proof of concept” (CVE record). The new tool also checks for CVE-2026-96940, a separate Exchange privilege escalation fixed on 2 October (c5z54, Microsoft).
  • Microsoft said in August that it was not exploited and that exploitation was “less likely” (Microsoft). We have found no report of attacks in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog. CIRCL's Vulnerability-Lookup logged the new tool on 2 November.

Unverified exploit code is sometimes laced with malware, so don't run it to test your own server.

What to do

  • Run Microsoft's Exchange Health Checker on each server. It reports whether the server is behind on updates (Microsoft).
  • Install the latest security update for your version (October 2026 at the time of writing). Updates are cumulative, so you don't need to install the missed ones in order (Microsoft). That covers CVE-2026-96940 too (Microsoft).
  • On Exchange 2016 or 2019 without ESU, plan the move to Exchange SE or Exchange Online now. Microsoft has stopped releasing fixes for them (Microsoft).
  • If a server stayed unpatched, look for .aspx files you didn't add under the IIS folders, such as aspnet_client, where the public exploit writes its webshell (hypnguyen1209).
  • Exchange looked after by an IT provider? Ask them which build each server is on today.

How we can help

Not sure what your Exchange server is running, or whether it has been tampered with? Get in touch.

Sources