Critical Exchange Server Pre-Auth RCE Vulnerability (CVE-2026-62911) Publicly Disclosed with PoC

Security researchers have publicly disclosed technical details and proof-of-concept (PoC) exploit code for a critical pre-authentication Remote Code Execution (RCE) vulnerability in Microsoft Exchange Server, tracked as CVE-2026-62911. The flaw allows unauthenticated attackers on local networks to achieve SYSTEM-level remote code execution. Microsoft released patches for this vulnerability during its August 2026 security updates, and administrators are urged to apply them immediately, especially for Exchange Server 2016 which requires Extended Security Updates (ESU) due to its end-of-life status.