Nearly 22,000 Microsoft Exchange servers remain exposed on the public internet without a patch for CVE-2026-62911, a high-severity authentication bypass that lets an attacker take over every user’s mailbox on the affected server. The flaw, discovered by DEVCORE Research Team’s Orange Tsai and fixed in Microsoft’s August 2026 Patch Tuesday, allows a threat actor with basic network access to bypass authentication through a capture-replay technique, then elevate their privileges to read, send, and download attachments from every mailbox on the server. Exploit code for the vulnerability is already publicly available, according to the Netherlands National Cyber Security Centre (NCSC-NL), and Germany’s Federal Office for Information Security (BSI) warned that approximately 85% of all on-premises Exchange servers in Germany are still unpatched.
Security watchdog Shadowserver found 21,899 IP addresses with Exchange Server fingerprints still vulnerable and reachable from the internet, with the largest concentrations in the United States (6,200 servers) and Germany (5,100 servers). CVE-2026-62911 has not yet been reported as actively exploited in the wild, but Exchange Server vulnerabilities have historically attracted ransomware operators quickly after public disclosure — CISA has added 20 Exchange Server flaws to its Known Exploited Vulnerabilities catalog since 2021, 14 of them tied to ransomware campaigns. Microsoft has also reminded customers that Exchange 2016 and Exchange 2019 will stop receiving security updates through the Extended Security Update program in October 2026, making prompt patching even more urgent.
How to check if you’re affected
Affected versions include Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). If your organization runs any of these versions on-premises, apply the August 2026 Patch Tuesday update immediately. NCSC-NL specifically advises that if Exchange 2016 or 2019 servers cannot be updated right away, they should be accessible only from internal networks — not exposed directly to the internet — while a migration to a supported version is planned. Exchange Online (Microsoft 365) is not affected.