PoC released for critical Exchange Server RCE vulnerability (CVE-2026-62911)
cyb3rops · x · 2026-08-26
A proof-of-concept (PoC) has been released for Microsoft Exchange Server vulnerability CVE-2026-62911, a pre-authentication remote code execution (RCE) flaw requiring no credentials. The exploit leverages a lack of Extended Protection on an HTTP.sys endpoint to relay machine account hashes, gaining privileges. It then abuses a file write parameter to drop an ASPX webshell, resulting in full SYSTEM takeover.
More from Safety
- ASML CFO says US Match Act restricting DUV sales to China would backfire — pstAsiatech · 2026-10-15
- Rumor: New Anthropic model imminent, apparently behind a batch of high-severity Chrome CVEs — matthew_d_green · 2026-10-15
- Fully-automated combat drones are already on the battlefield, warns Toby Walsh — TobyWalsh · 2026-10-15
- Pope's AI adviser warns Australia's copyright changes risk a new form of colonialism — TobyWalsh · 2026-10-15
- Jamie Dimon Warns of AI Agent Risks to Bank Accounts; JPMorgan Blocks Outside Agents — AccBalanced · 2026-10-15
- 'A lot of you are into alignment faking': meme nod to Anthropic's alignment faking paper — dejavucoder · 2026-10-15