CVE-2026-62911: Microsoft Exchange Privilege Escalation via Improper Authorization (ZDI-26-538) — Detection and Remediation Guide | Security Arsenal

Another Pwn2Own Exchange bug just moved from the contest stage into the advisory pipeline — and this one carries the two characteristics that make Exchange vulnerabilities uniquely dangerous: remote exploitability and an authentication mechanism that can be bypassed.

The Zero Day Initiative has published ZDI-26-538, covering CVE-2026-62911, an improper authorization vulnerability in Microsoft Exchange Server that allows a remote attacker to escalate privileges on affected installations. ZDI rates it CVSS 8.8 (High). The advisory notes that while authentication is nominally required to trigger the flaw, the existing authentication mechanism can itself be bypassed — which functionally lowers the bar toward pre-authentication attack surface.

If you run on-premises Exchange (or hybrid Exchange with internet-facing Client Access services), this advisory should be treated as an urgent patch-and-hunt event. Exchange remains one of the most consistently targeted enterprise assets in the world: it holds the keys to corporate identity (it typically runs with extensive privileges in Active Directory), it is internet-facing by design, and its attack surface (OWA, ECP, EWS, Autodiscover) is well mapped by both researchers and threat actors.

Technical Analysis

What We Know

Attribute	Detail
CVE	CVE-2026-62911
Advisory	ZDI-26-538
Source	Pwn2Own (researcher disclosure via ZDI program)
CVSS	8.8 (High)
Attack vector	Remote, over Exchange web services
Authentication	Required — but the authentication mechanism can be bypassed
Impact	Privilege escalation on the Exchange server
Affected product	Microsoft Exchange Server (on-premises installations)

How Improper Authorization Flaws in Exchange Typically Manifest

ZDI's advisory language — "improper authorization" combined with a bypassable authentication mechanism — describes a well-understood failure class in Exchange's Client Access architecture. From a defender's perspective, the realistic attack chain looks like this:

Reconnaissance: The attacker fingerprints internet-facing Exchange virtual directories (/owa, /ecp, /ews, /autodiscover, /mapi) to identify vulnerable builds.
Authentication bypass: The attacker exploits the weakness in the authentication handling path — historically in Exchange this has involved token validation, serialization, or request-path canonicalization issues between the front-end HTTP proxy and the back-end service — to obtain an authenticated context without valid credentials.
Privilege escalation: With a valid (or forged) authenticated session, the attacker invokes functionality that fails to properly authorize the caller against the requested operation. Because the Exchange application pool (MSExchange*AppPool, running as SYSTEM under w3wp.exe) and several Exchange services run with highly privileged contexts, successful exploitation yields code execution or privileged operations as NT AUTHORITY\SYSTEM.
Post-exploitation: From SYSTEM on Exchange, attackers historically pivot to credential theft (LSASS on a server that authenticates every mailbox user), web shell deployment into ClientAccess virtual directories for persistence, and lateral movement into Active Directory — the Exchange server computer account is a member of the powerful Exchange Windows Permissions and Exchange Trusted Subsystem groups.

Why the CVSS 8.8 May Understate Real-World Risk

A CVSS 8.8 with an AC:H or auth-required vector looks moderate on paper. In practice:

The auth bypass note changes the calculus. If the authentication requirement can be sidestepped, the effective pre-condition collapses and the exposure approaches that of prior pre-authenticated Exchange RCE chains.
Exchange servers are identity hubs. A compromised Exchange server is rarely the end goal — it is a beachhead into AD, email content, and OAuth/identity infrastructure.
Pwn2Own provenance means working exploit code exists. The vulnerability was demonstrated under competition conditions. ZDI advisories precede or accompany vendor patches; once patch binaries ship, diffing produces working exploits quickly — historically within days for Exchange.

Exploitation Status

As of this writing, CVE-2026-62911 is a Pwn2Own-demonstrated vulnerability disclosed through ZDI's coordinated disclosure process. There is no confirmed in-the-wild exploitation and no CISA KEV listing yet — but defenders should not take comfort in that. Every major Exchange mass-exploitation wave of the last several years began exactly here: a demonstrated bug, an advisory, a patch, and then rapid weaponization once exploit details could be derived. The window between patch availability and opportunistic scanning of /owa and /ecp endpoints has consistently been measured in days, not weeks. Treat this as pre-KEV urgent.

Detection & Response

Because the precise pre-patch indicators for CVE-2026-62911 are limited, detection strategy should focus on the high-fidelity post-exploitation behaviors that any successful Exchange privilege escalation produces: IIS worker processes spawning command interpreters, files written into Exchange ClientAccess directories, and anomalous privileged group modifications sourced from the Exchange server.

Sigma Rules

YAML

---
title: Exchange IIS Worker Process Spawning Command Shell or Scripting Engine
id: 3f8c2a91-6b4d-4e7a-9c51-2d8e4f6a1b90
status: experimental
description: Detects w3wp.exe (including Exchange application pools) spawning cmd.exe, powershell.exe, or other scripting engines — a hallmark of Exchange web exploitation leading to privilege escalation such as CVE-2026-62911 post-exploitation activity.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-538/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Exchange application pools do not legitimately spawn command shells in normal operations. Validate any hit immediately.
level: high
---
title: File Written to Exchange ClientAccess Virtual Directories
id: 8a1d4e62-3c7b-4f29-a5d8-6e9b1c4f7a23
status: experimental
description: Detects creation or modification of ASPX, ASHX, or script files within Exchange ClientAccess and FrontEnd directories — consistent with web shell deployment following exploitation of Exchange vulnerabilities such as CVE-2026-62911.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-538/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\'
      - '\Microsoft\Exchange Server\V15\ClientAccess\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.config'
  condition: selection_path and selection_ext
falsepositives:
  - Cumulative Update / Security Update installation and servicing — correlate with patch windows and setup process lineage.
level: high
---
title: Privileged Local Group Modification Sourced from Exchange Server Context
id: c47e2b15-9f3a-4d68-b1c4-5a8d2e7f9b36
status: experimental
description: Detects additions to Administrators or other privileged local groups executed by processes running under SYSTEM or Exchange service contexts on Exchange servers — a common privilege consolidation step after exploitation of authorization flaws like CVE-2026-62911.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-538/
  - https://attack.mitre.org/techniques/T1136/001/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'localgroup administrators'
      - 'localgroup "Remote Desktop Users"'
      - 'Add-LocalGroupMember'
  selection_add:
    CommandLine|contains:
      - 'add'
      - '-Member'
  condition: selection_cmd and selection_add
falsepositives:
  - Legitimate administrator group management — scope via Exchange server asset list and validate against change tickets.
level: medium

KQL (Microsoft Sentinel / Defender)

The following hunts cover both endpoint process lineage on the Exchange server and network-level probing of Exchange virtual directories (via WAF/IIS logs ingested as CommonSecurityLog or AzureDiagnostics).

KQL — Microsoft Sentinel / Defender

// Hunt 1: Exchange IIS worker process spawning suspicious child processes
// Run against Exchange servers; tighten TimeGenerated as needed.
let ExchangeServers = dynamic(["EXCH01", "EXCH02"]); // replace with your Exchange asset list
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any (ExchangeServers)
| where InitiatingProcessFileName =~ "w3wp.exe"
   or InitiatingProcessCommandLine has_any ("MSExchangeOWAAppPool", "MSExchangeECPAppPool", "MSExchangeServicesAppPool", "MSExchangeSyncAppPool", "MSExchangeAutodiscoverAppPool")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "net.exe", "net1.exe", "whoami.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: Script file writes into Exchange ClientAccess / FrontEnd paths
let ExchangeServers = dynamic(["EXCH01", "EXCH02"]);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any (ExchangeServers)
| where FolderPath has_any ("\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\", "\\Microsoft\\Exchange Server\\V15\\ClientAccess\\")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx" or FileName endswith ".asp"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 3: Abnormal request volume / error patterns against Exchange auth-sensitive virtual directories
// Requires IIS/WAF logs ingested via CommonSecurityLog (CEF) or custom IIS log collection.
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/ecp", "/ews", "/autodiscover", "/owa", "/mapi")
| summarize Requests = count(), DistinctURLs = dcount(RequestURL), StatusCodes = make_set(AdditionalExtensions) by SourceIP, bin(TimeGenerated, 1h)
| where Requests > 500 or DistinctURLs > 50
| order by Requests desc;

Velociraptor VQL

For on-demand forensics across your Exchange estate — enumerate recently modified script files in ClientAccess paths and w3wp child process lineage:

VQL — Velociraptor

-- CVE-2026-62911 Exchange hunt: web shell artifacts and suspicious IIS child processes
-- Deploy as a client artifact scoped to Exchange servers.

-- 1) Recently written/modified script files in Exchange web directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.aspx',
    'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.ashx',
    'C:/Program Files/Microsoft/Exchange Server/V15/ClientAccess/**/*.aspx',
    'C:/Program Files/Microsoft/Exchange Server/V15/ClientAccess/**/*.ashx'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

-- 2) w3wp.exe processes with suspicious command-line lineage or children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'w3wp|cmd|powershell|pwsh|cscript|wscript|mshta'
  AND (CommandLine =~ 'MSExchange' OR Username =~ 'SYSTEM')
ORDER BY CreateTime DESC

-- 3) Network listeners and outbound connections from IIS worker processes
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ 'w3wp.exe'
  AND NOT (Raddr =~ '^10\\.|^192\\.168\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.' AND Rport in (80, 443))

Verification & Hardening Script

Run this on each Exchange server (elevated) to establish current patch posture, confirm whether the relevant security update is installed, and tighten high-risk surfaces while you schedule patching:

PowerShell

# CVE-2026-62911 (ZDI-26-538) — Exchange posture verification and interim hardening
# Run elevated on each Exchange server. Review output before applying hardening changes.

# --- 1. Establish Exchange build and CU/SU level ---
$ExchKey = 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup'
$CU = (Get-ItemProperty -Path $ExchKey -Name 'MsiProductMajor','MsiProductMinor' -ErrorAction SilentlyContinue)
Write-Host "=== Exchange Build ===" -ForegroundColor Cyan
Get-Command ExSetup.exe -ErrorAction SilentlyContinue | ForEach-Object { $_.FileVersionInfo } | Format-List ProductVersion, FileVersion
# Cross-reference the build number against Microsoft's official Exchange Server build
# numbers and release dates page to confirm the latest SU is applied.

# --- 2. List installed Exchange security updates (last 180 days) ---
Write-Host "=== Recent Installed Updates ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-180) } |
  Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize

# --- 3. Verify Extended Protection is enabled (Microsoft-recommended mitigation for auth relay/bypass classes) ---
Write-Host "=== Extended Protection / Auth Settings on Exchange vDirs ===" -ForegroundColor Cyan
Import-Module WebAdministration -ErrorAction SilentlyContinue
$vDirs = @('IIS:\Sites\Default Web Site\owa','IIS:\Sites\Default Web Site\ecp','IIS:\Sites\Default Web Site\ews','IIS:\Sites\Default Web Site\mapi','IIS:\Sites\Default Web Site\autodiscover')
foreach ($vd in $vDirs) {
  $ep = Get-WebConfigurationProperty -Filter 'system.webServer/security/authentication/windowsAuthentication' -PSPath $vd -Name 'extendedProtection.tokenChecking' -ErrorAction SilentlyContinue
  Write-Host "$vd : ExtendedProtection = $($ep.Value)"
}

# --- 4. Audit ClientAccess directories for recently modified script files (web shell triage) ---
Write-Host "=== Recently Modified Script Files in Exchange Web Paths ===" -ForegroundColor Cyan
$paths = @('C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy','C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess')
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, LastWriteTime | Format-Table -AutoSize
}

# --- 5. Confirm AMSI is enabled for Exchange (HttpFiltering) ---
Write-Host "=== AMSI / Antimalware Scanning State ===" -ForegroundColor Cyan
Get-WindowsOptionalFeature -Online -FeatureName 'IIS-ASPNET45' -ErrorAction SilentlyContinue | Select-Object FeatureName, State
# Verify the Exchange AMSI integration is not disabled:
Get-SettingOverride -ErrorAction SilentlyContinue | Where-Object { $_.ComponentName -eq 'Cafe' -and $_.SectionName -like '*Amsi*' } | Format-List

# --- 6. Restrict ECP exposure as interim risk reduction (do NOT run on production without change control) ---
# Option A: Disable external ECP via IIS IP restrictions or your WAF.
# Option B: Set ECP adminEnabled to restrict EAC access from the internet-facing site:
# Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdminEnabled $false
Write-Host "Review ECP exposure: consider -AdminEnabled hardening per Microsoft guidance." -ForegroundColor Yellow

Write-Host "Next: apply the Microsoft security update addressing CVE-2026-62911, then re-run steps 1-4." -ForegroundColor Green

Remediation

Apply the Microsoft security update for CVE-2026-62911 immediately. Track the ZDI advisory (ZDI-26-538) and Microsoft's Security Update Guide entry for CVE-2026-62911 for the exact KB and build numbers applicable to your Exchange version (Exchange Server 2016/2019 and Subscription Edition each have distinct SU packages). Verify post-patch build against Microsoft's official Exchange build number matrix — do not rely on Get-HotFix alone, as Exchange SUs are cumulative per CU.
Deploy Microsoft Exchange Emergency Mitigation (EM) service if not already active. EM automatically applies Microsoft-published interim mitigations for Exchange vulnerabilities between SU cycles and is one of the fastest compensating controls available.
Enable or verify Extended Protection for Authentication across all Exchange virtual directories using Microsoft's official configuration script. Extended Protection directly mitigates authentication relay and authentication-handling weaknesses — precisely the class of issue flagged in this advisory's "authentication mechanism can be bypassed" language.
Reduce internet-facing surface area:
- Block or geo-restrict /ecp externally; there is almost never a legitimate reason for internet-facing Exchange admin access.
- Place Exchange behind a WAF/reverse proxy with virtual-directory-aware rules and request-rate anomaly detection.
- If you are hybrid-only, revisit whether on-premises Exchange services need any external exposure at all.
Enforce least privilege on Exchange service and computer accounts. Audit membership of Exchange Trusted Subsystem and Exchange Windows Permissions; these groups are high-value post-exploitation pivot points into Active Directory.
Hunt before you assume clean. Because exploitation precedes patching in most Exchange incidents, run the Sigma, KQL, and VQL content above retroactively (30 days minimum) before and after applying the update. A patched server that was compromised last month is still compromised.
Prepare for KEV escalation. Given Pwn2Own provenance and Exchange's exploitation history, pre-stage your emergency change process now. If CISA adds CVE-2026-62911 to the Known Exploited Vulnerabilities catalog, federal civilian agencies will face a Binding Operational Directive remediation deadline — treat that same timeline as your internal SLA.

Bottom Line

CVE-2026-62911 is exactly the kind of vulnerability that becomes next quarter's incident report. A remote privilege escalation against Exchange with a bypassable authentication mechanism, demonstrated at Pwn2Own, will attract researcher and adversary attention the moment patch binaries are diffable. Patch fast, hunt first, and shrink the internet-facing footprint of a service that has repeatedly proven to be the front door of the enterprise.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-62911: Microsoft Exchange Privilege Escalation via Improper Authorization (ZDI-26-538) — Detection and Remediation Guide