A high-severity authentication weakness in Microsoft Exchange Server has left nearly 22,000 internet-facing systems potentially exposed, raising concerns that attackers could seize control of corporate mailboxes, impersonate employees and use compromised email infrastructure to penetrate deeper into enterprise networks.
The vulnerability, tracked asCVE-2026-62911, affects on-premises installations of Microsoft Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition. Microsoft released security updates addressing the flaw onAugust 11as part of its August 2026 Patch Tuesday rollout.
Despite the availability of patches, internet-scanning data published at the end of August indicates that a substantial number of Exchange installations remain vulnerable. The risk has become more urgent following reports that technical details and exploit code are now publicly available.
The flaw was reported to Microsoft by security researcher Orange Tsai of DEVCORE’s research team, whose work has previously uncovered several major Exchange Server attack chains.
Microsoft classifiesCVE-2026-62911as an elevation-of-privilege vulnerability caused by an authentication bypass through capture-and-replay techniques. Successful exploitation could allow an attacker to take over Exchange mailboxes, read private messages, download attachments and send email while impersonating legitimate users.
Microsoft assigned the issue a CVSS severity score of 8.0 out of 10. However, separate technical advisories describing the underlying research suggest its practical impact may be broader than the short vendor description initially indicates.
Almost 22,000 vulnerable servers detected online
The Shadowserver Foundation, a nonprofit organization that scans the internet for exposed and vulnerable systems, identified21,899 unique IP addressesdisplaying Microsoft Exchange fingerprints associated with unpatched versions ofCVE-2026-62911between August 27 and August 31.
The largest concentration was found in the United States, where approximately 6,200 potentially vulnerable systems were detected. Germany accounted for roughly 5,100 systems, making it the second most affected country in Shadowserver’s scan.
Shadowserver’s measurements are based primarily on remotely observed software versions and internet-facing service fingerprints. The figures therefore represent systems believed to be vulnerable rather than confirmed instances on which exploitation was successfully tested.
Even with that qualification, the scale of the exposure is significant. Exchange servers commonly hold years of sensitive communications, business documents, password-reset messages, financial correspondence, legal discussions and information about employees, customers and suppliers.
Because these servers are frequently integrated with Active Directory and other internal services, compromising Exchange can provide attackers with considerably more than access to email.
Germany’s Federal Office for Information Security, or BSI, separately warned that approximately85% of on-premises Exchange servers detected in Germanyhad not yet been protected against the vulnerability.
The concentration of exposed servers in two of the world’s largest economies highlights the continuing difficulty organizations face in maintaining on-premises email infrastructure, particularly when older Exchange versions are approaching the end of their remaining security-update arrangements.
How the authentication bypass works
CVE-2026-62911is categorized asCWE-294: Authentication Bypass by Capture-Replay.
In a capture-and-replay attack, an adversary records or obtains authentication material exchanged during a legitimate connection and then retransmits it to another service or endpoint. The attacker does not necessarily need to recover the user’s plaintext password. Instead, the objective is to reuse authentication data in a context where the receiving system incorrectly accepts it as proof of identity.
This distinction matters because password changes and multifactor authentication do not automatically eliminate every replay or relay scenario. If a server does not sufficiently bind an authentication exchange to the intended connection, endpoint or session, captured credentials or tokens may be accepted somewhere they were never intended to be used.
Microsoft’s public risk assessment states that exploitation involves network access, low complexity, low privileges and user interaction. According to the company, a successful attacker could take over every user mailbox hosted on the affected Exchange environment.
The Netherlands’ National Cyber Security Centre(NCSC-NL),however, has described the exposure in more severe terms, warning that an attacker may be able to execute malicious code remotely without possessing login credentials.NCSC-NLsaid exploitation could provide access to email accounts and potentially enable further movement through the victim’s network.
These descriptions are not necessarily mutually exclusive. Microsoft’s CVE entry summarizes the vulnerability using its standardized scoring model, while the Dutch agency appears to assess the wider attack chain demonstrated by the researchers. The authentication bypass can serve as an entry point that makes additional flaws or Exchange functionality reachable, ultimately producing a more serious result than mailbox access alone.
Organizations should therefore avoid interpreting the “privileges required” and “user interaction required” fields as evidence that internet-facing Exchange servers are at low risk.
Vulnerability linked to Pwn2Own Exchange compromise
The Zero Day Initiative (ZDI) publishedadvisoriesprovide further insight into the vulnerability’s origin and potential impact.
CVE-2026-62911is associated with a successful Exchange Server compromise demonstrated by Orange Tsai during thePwn2Own Berlin 2026hacking competition. The researcher chained three security weaknesses to achieve code execution with SYSTEM privileges on the targeted Exchange server, earning a $200,000 award.
ZDI published three related advisories under the same CVE identifier:
- ZDI-26-534describes a capture-replay authentication bypass.
- ZDI-26-535covers external control of a file path that can lead to remote code execution.
- ZDI-26-538documents an improper authorization weakness that can enable privilege escalation.
Together, these findings show why the vulnerability may be more dangerous in practice than an isolated “elevation of privilege” label suggests.
An authentication bypass can defeat the barrier protecting a privileged Exchange feature. A second weakness can then allow the attacker to manipulate a file path or write data to a sensitive location. A third authorization flaw may provide the permissions necessary to complete the compromise.
When chained, those primitives can potentially lead from an external connection to arbitrary code execution under the highly privileged SYSTEM account.
This does not mean every attempt againstCVE-2026-62911will automatically produce complete server compromise. Attack chains depend on configuration, network reachability, enabled services and other technical conditions. Nevertheless, the successful Pwn2Own demonstration establishes that the vulnerabilities are practically exploitable rather than merely theoretical.
Public exploit code raises the risk of widespread scanning
NCSC-NLreported that exploit code forCVE-2026-62911is publicly available and urged organizations to install Microsoft’s updates immediately.
The release of proof-of-concept code often changes the threat environment around a vulnerability. Before technical details become public, exploitation may be limited to the original researchers, well-resourced intelligence services or attackers that independently discovered the flaw. Once working code or a detailed attack chain is released, a much broader group can analyze and adapt it.
That group may include ransomware operators, initial-access brokers, botnet developers and opportunistic attackers scanning the internet for systems that missed a security update.
Public exploit availability is not, by itself, proof that malicious exploitation is occurring. As of September 1, Microsoft had not markedCVE-2026-62911as exploited, and the vulnerability had not been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog.
There is therefore an important difference between a vulnerability being exploitable and it being confirmed as exploited in real attacks.
However, Exchange Server’s history suggests that defenders should not wait for evidence of mass exploitation before acting. Previous Exchange vulnerabilities have frequently been weaponized soon after disclosure, with attackers using compromised servers to deploy web shells, steal credentials, exfiltrate email and establish access for subsequent ransomware operations.
Mailbox takeover creates broader enterprise risk
The immediate consequence ofCVE-2026-62911is the possibility of unauthorized access to all mailboxes in an affected Exchange environment.
- Confidential conversations between executives and board members
- Legal documents and attorney correspondence
- Customer and employee personal information
- Invoices, payment instructions and banking details
- Password-reset links and account-enrolment messages
- Security alerts and incident-response discussions
- Contracts, intellectual property and commercially sensitive attachments
Mailbox access also creates a powerful impersonation channel. An attacker sending messages from a real executive, finance employee or trusted internal account can bypass many of the warning signs associated with conventional phishing.
Recipients may see an expected address, a valid corporate domain and an authentic conversation history. Attackers can study existing threads and insert fraudulent payment instructions, malicious links or requests for credentials into otherwise legitimate exchanges.
This creates opportunities for business email compromise, payroll fraud, supplier-payment diversion and highly targeted social-engineering attacks.
An Exchange compromise can also undermine incident response. Attackers with access to security-team mailboxes may be able to monitor investigations, identify containment plans and learn which indicators defenders have discovered. They could delete warnings, redirect messages or use inbox rules to conceal malicious activity.
If the Exchange server itself is compromised at the operating-system level, the attacker may gain a persistent foothold inside the organization. From there, stolen service credentials, Active Directory access and trusted connections to other systems could support lateral movement.
Exchange remains a high-value target
On-premises Exchange has been one of the most aggressively targeted enterprise platforms of the past several years.
The 2021 ProxyLogon campaign demonstrated how quickly Exchange exploitation could scale. Attackers compromised large numbers of servers, installed web shells and created persistent access before many organizations could apply updates.
Subsequent vulnerability families—including ProxyShell, ProxyNotShell and ProxyToken—continued to expose weaknesses in Exchange’s authentication, authorization and request-processing architecture.
CISA’s Known Exploited Vulnerabilities Catalogcontains numerous Exchange Server flaws that have been observed in real attacks. Several are also marked as associated with ransomware activity.
This history makes internet-facing Exchange servers especially attractive to attackers. Unlike an ordinary workstation, an Exchange system is generally always online, reachable through predictable endpoints and entrusted with an organization’s most sensitive communications. It may also have extensive access to identity infrastructure.
Attackers do not necessarily need to know which organization owns a server before attempting exploitation. Automated scanning can identify Exchange endpoints, determine likely software versions and launch attacks at scale.
Once a system is compromised, the victim’s identity and strategic value can be assessed later.
Older Exchange installations face a shrinking support window
The exposure arrives during a difficult transition period for organizations still operating Exchange Server 2016 and Exchange Server 2019.
Both products reached the end of normal support on October 14, 2025. Microsoft subsequently made security fixes available to enrolled customers through a temporary Extended Security Update program.
The second ESU period began in May 2026 and is scheduled to end at the close of October 2026. After that point, Microsoft says security updates for Exchange 2016 and 2019 will no longer be issued through the program.
The August updates coveringCVE-2026-62911are therefore available to eligible ESU customers, but the arrangement provides only a short-term bridge. It is not a permanent support strategy.
Organizations running the older products without ESU coverage may be unable to obtain the necessary fixes through the normal update process.NCSC-NLhas advised such organizations to restrict affected servers to internal access and replace them where possible.
Microsoft’s supported on-premises successor isExchange Server Subscription Edition. Organizations may also migrate mailboxes and associated services to Microsoft 365, depending on regulatory, operational and data-residency requirements.
Migration is rarely a simple emergency action. Exchange environments may support legacy applications, hybrid identity arrangements, mail relays, compliance archives and custom integrations. Even so, the approaching end of ESU coverage means organizations should treat migration as a security deadline rather than an optional modernization project.
What administrators should do now
Organizations should begin by identifying every Exchange server in their environment, including systems that no longer host active user mailboxes but remain deployed for management, mail relay, hybrid connectivity or legacy applications.
Administrators should confirm the exact Exchange version, cumulative update level and installed August 2026 security update. Microsoft’s Exchange build-number documentation can be used to compare deployed versions with fixed releases.
The update should be installed through the documented Exchange servicing process. Administrators must also verify that installation completed successfully across every server rather than relying solely on the presence of an update package or an apparently successful deployment job.
Microsoft’s August Exchange release notes should be reviewed for prerequisites, known issues and post-installation requirements. The company said OWA Light was disabled beginning with the August 2026 security update and advised customers unable to install the update to disable that feature as an interim measure for a related issue. Such mitigations should not be treated as substitutes for theCVE-2026-62911security update unless Microsoft explicitly states that they fully address it.
Internet exposure should also be reduced. Exchange administrative interfaces and services that do not need to be publicly accessible should be restricted using firewalls, VPNs, application proxies or other access controls.
Security teams should examine Exchange and Windows logs for unexpected authentication events, suspicious mailbox access, newly created inbox rules, abnormal message forwarding and unusual administrative activity. They should also search for recently created ASPX files, web shells, unfamiliar scheduled tasks, new services and unexplained child processes launched by Exchange or IIS components.
Where compromise is suspected, simply installing the update is not enough. Patching prevents further exploitation of the corrected vulnerability but does not remove persistence, stolen credentials or malware already established on the server.
Potentially affected organizations should preserve logs, isolate compromised hosts where operationally possible, investigate Active Directory activity and rotate credentials that may have been exposed. Privileged, service and machine-account credentials deserve particular attention.
A patching problem with strategic consequences
The discovery of almost 22,000 potentially vulnerable Exchange servers illustrates the gap between the release of a security update and its deployment across the global technology estate.
For many organizations, Exchange is difficult to update because it is operationally critical. Administrators may need maintenance windows, backups, compatibility testing and rollback plans. Those legitimate requirements can delay deployment, particularly in complex or understaffed environments.
Attackers face none of those constraints.
With public technical information available and tens of thousands of systems identifiable from the internet, the window for preventive action is narrowing. Even without confirmed malicious exploitation,CVE-2026-62911combines several characteristics defenders should treat seriously: an exposed enterprise service, an authentication-boundary failure, demonstrated SYSTEM-level exploitation, public exploit material and a large unpatched population.
Organizations running Exchange Server 2016 or 2019 face an additional strategic decision. Applying the August update addresses the immediate threat, but the approaching end of the ESU program means the same organizations could soon be left without patches for future vulnerabilities.
The immediate priority is to update, reduce exposure and investigate for compromise. The longer-term requirement is to move remaining email infrastructure onto a supported platform before the temporary security-update window closes.
Read:Microsoft Exchange supportability matrix
