Executive Summary
Security researchers have identified a complex remote code execution (RCE) chain targeting the latest versions of Microsoft Exchange Server, specifically focusing on the Mailbox Replication Proxy Service (MRSProxy). The vulnerability, tracked as CVE-2026-62911, leverages the PST export trick similar to historical ProxyShell exploits but utilizes a different sink to bypass modern restrictions.
The attack involves bypassing hardened EWS protections by targeting a secondary endpoint, `/Microsoft.Exchange.MailboxReplicationService.ProxyService`, which is exposed directly via HTTP.sys. Although this endpoint requires Negotiate/NTLM authentication restricted to machine accounts, researchers demonstrated that an attacker with low-privileged network access can use the PetitPotam (MS-EFSR) trick to force an Exchange server to authenticate to an attacker-controlled UNC path. This authentication can then be relayed to another Exchange server in the environment, granting the attacker the necessary rights to perform unauthorized file writes and achieve RCE. This threat is particularly relevant for environments with multiple Exchange servers where outbound SMB traffic and inter-server communication are not strictly segmented.