Microsoft is working to resolve a known issue that causes delays or blocks some users from opening the Microsoft Teams desktop client on Windows systems. [...]
Microsoft is developing a new security feature for Teams messaging that will obscure QR codes sent by external users. This measure aims to help organizations reduce phishing and fraud risks associated with malicious QR code campaigns. Listed under Microsoft 365 Roadmap ID 570439, this feature is currently in development and is scheduled for rollout in […]
A Microsoft 365 email security-control bypass that lets attackers submit unauthenticated messages posing as internal users by leaving one SMTP field blank. The technique targets Exchange Online’s RejectDirectSend setting and does not represent a vulnerability in Microsoft software or in ReliaQuest systems; instead, it exposes a limitation in how the control evaluates Direct Send traffic. […]
Microsoft says a known issue that reverts mouse settings after installing the KB5120998 August 2026 preview update affects only non-English Windows 11 systems. [...]
Microsoft will start automatically enabling Memory Integrity protection on eligible Windows devices through quality updates beginning in October 2026. This change aims to strengthen defenses against kernel-level attacks by ensuring that only trusted kernel-mode code and drivers can run on supported systems. Memory Integrity is a security feature built on Virtualization-based Security (VBS), a Windows […]
Microsoft has confirmed that desktop settings are lost or reset on some Windows devices after installing the KB5120998 August 2026 preview update. [...]
Microsoft is working to fix a known issue that causes crashes and launch failures for Microsoft Teams and New Outlook users after installing updates released since the August 2026 Patch Tuesday. [...]
Microsoft is investigating an issue causing the Defender for Office 365 security software to mistakenly block access to legitimate Google search links. [...]
Microsoft alerts IT admins that hotpatch-enrolled systems will require unexpected mandatory reboots in September and October. Prepare for potential downtime.
While Microsoft classifies the issue as an elevation-of-privilege flaw, the published research describes an attack chain that can lead to unauthenticated remote code execution and a SYSTEM-level compromise on vulnerable Exchange environments.
The PoC, published on GitHub by researcher Nguyen Van Hiep, targets the Exchange Mailbox Replication Proxy service, commonly known as MRSProxy.
The exploit documentation claims that a reachable HTTP. sys-hosted MRSProxy endpoint does not enforce Extended Protection for Authentication, enabling an attacker to relay NTLM authentication from an Exchange machine account to the service.
Microsoft’s public description states that an authorized attacker could elevate privileges over a network. In contrast, the available PoC increases practical risk by demonstrating an NTLM relay path that may eliminate the need for prior Exchange credentials in certain configurations.
According to the technical analysis, Exchange exposes MRSProxy through separate endpoints. Extended Protection protects the IIS-hosted /EWS/MRSProxy.svc path.
However, the HTTPsys-hosted MailboxReplicationService ProxyService endpoint may not validate channel bindings. This creates a relay opportunity where a captured machine-account authentication attempt can be forwarded to the vulnerable Exchange service.
The attack chain begins by coercing an Exchange server to authenticate to an attacker-controlled listener through a technique such as PetitPotam. The attacker can then relay the NTLM authentication to a second vulnerable Exchange server.
If the relay succeeds, the machine account is treated as authenticated by MRSProxy. It receives access to Exchange mailbox replication functionality.
The PoC reportedly abuses WCF methods within the replication service, including IMailbox_Config6 and IMailbox_Connect. The first method accepts a file path, while the second may cause Exchange to write content to that location.
An attacker could attempt to place an ASPX webshell into a web-accessible IIS or Exchange virtual directory, then access the file remotely to execute commands under the Exchange service context. Public reporting and technical analysis describe a potential SYSTEM-level outcome.
The vulnerability is associated with a three-bug chain demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026. The Exchange compromise earned a $200,000 reward during the competition, underscoring the security impact of chained authentication and service-level weaknesses.
Affected products include Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. Organizations should deploy Microsoft’s August 2026 Exchange security updates immediately.
Fixed builds include Exchange 2016 CU23 (version 15.1.2507.72), Exchange 2019 CU14 (version 15.2.1544.44), Exchange 2019 CU15 (version 15.2.1748.49), and Exchange Server Subscription Edition (version 15.2.2562.46).
Exchange 2016 reached end of support in October 2025, meaning organizations without Extended Security Updates may not have a supported remediation path.
Administrators should also verify Extended Protection settings, reduce unnecessary exposure of Exchange services, monitor for unusual NTLM relay activity, and investigate unexpected ASPX files in Exchange and IIS directories.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. [...]
Microsoft is investigating a widespread service issue causing authentication issues, email delays and failures, and various other issues for Exchange Online customers. [...]
Learn about the latest Windows 11 KB5120998 bugs causing desktop black screens and cursor glitches. Find out how to uninstall this optional update safely.
Microsoft has confirmed an issue with Microsoft Defender Antivirus that generates false notifications on Windows systems, claiming “Microsoft Defender Antivirus is turned off,” even though the protection is still operational. These alerts may appear after installing the latest Defender updates, potentially causing unnecessary concern for administrators who observe that Defender settings are healthy and security […]
Discover how upcoming Windows 11 Phone Link updates will let you remotely shut down, restart, or sleep your PC directly from your Android mobile device.
Entrar
