What Changed
Shadowserver found 21,899 IP addresses with a Microsoft Exchange Server fingerprint that are exposed online and still unpatched against CVE-2026-62911. Most are in the United States (about 6,200) and Germany (about 5,100). Germany’s BSI says about 85% of on-premises Exchange servers in the country are still vulnerable.
CVE-2026-62911 is a high-severity authentication bypass by capture-replay, reported by Orange Tsai of DEVCORE. It affects Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition. Microsoft patched it in the August 2026 Patch Tuesday and said an attacker “would be able to take over the mailboxes of all Exchange users”, including sending and reading email and downloading attachments.
Exploit Status
The attacker needs only basic privileges on the server, and the attack is low complexity but requires user interaction. The Netherlands NCSC said exploit code is already available online. When BleepingComputer published, Microsoft had not confirmed that and the flaw had not been reported as exploited in the wild.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Exchange has a long history in CISA’s KEV catalog: 20 Exchange Server flaws since November 2021, 14 of them used in ransomware. That includes CVE-2026-42897, an Outlook Web Access XSS flaw patched in June that was exploited.
The Support Problem
Exchange 2016 and 2019 now get security updates only through the Extended Security Updates programme, and Microsoft says those updates stop in October 2026. The NCSC says anyone on those versions should keep the server reachable only from inside the network and replace it if possible.
What To Verify First
- Confirm every Exchange server has the August 2026 security update, including hybrid and management servers.
- Check whether Outlook on the web and other Exchange endpoints are reachable from the internet, and restrict them if not required.
- Review mailbox audit logs for access you cannot explain, and plan the move off Exchange 2016 and 2019 before ESU ends.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
