Nearly 22,000 Internet-Facing Exchange Servers Remain Exposed to Auth-Bypass Mailbox Hijacking Flaw
Telemetry from the Shadowserver Foundation indicates that approximately 21,899 internet-facing Microsoft Exchange servers remain vulnerable to a high-severity authentication bypass tracked as CVE-2026-62911. Discovered by security researcher Orange Tsai of DEVCORE at Pwn2Own Berlin 2026, the vulnerability netted a $200,000 bounty by demonstrating full system takeover capabilities. Microsoft subsequently issued patches for the flaw during the August 2026 Patch Tuesday cycle. The bug affects several core editions, specifically Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). An attacker holding basic authorized access on a network can leverage capture-replay techniques to elevate privileges across the environment. This flaw enables adversaries to commandeer all user mailboxes, allowing them to read communications, exfiltrate attachments, and dispatch emails under arbitrary identities. Public reporting from the Netherlands National Cyber Security Centre (NCSC-NL) and technical disclosures indicate that a functional Python-based proof-of-concept exploit is already circulating on GitHub. The available exploit chain demonstrates how this bug links with other weaknesses to compromise servers completely. In Germany, the Federal Office for Information Security (BSI) reported that approximately 85% of local on-premises installations have not yet implemented the fix. Geographic exposure mapping reveals the United States and Germany as the most affected regions, hosting roughly 6,200 and 5,100 vulnerable endpoints respectively. Fixed builds include Exchange Server 2016 CU23 (`15.1.2507.72`), Exchange 2019 CU14 (`15.2.1544.44`), Exchange 2019 CU15 (`15.2.1748.49`/`KB5121574`), and Exchange SE RTM (`15.2.2562.46`/`KB5121573`). Because legacy 2016 and 2019 platforms reached end-of-support in October 2025, operators must rely on the Extended Security Updates (ESU) channel to ingest these updates before support ends entirely.
Commentary
Exchange infrastructure exposed directly to the public web continues to be an Achilles' heel for corporate perimeters. While Shadowserver's methodology relies strictly on passive banner and build fingerprinting—meaning some instances behind reverse proxies or network filtering may not be exploitable—the presence of working Python PoCs dramatically shortens the runway to active exploitation. Organizations running on-premise Exchange need to verify their build numbers against the August 2026 security baselines immediately. If systems are running legacy 2016 or 2019 builds without an active ESU enrollment, perimeter controls should immediately pull those hosts off the public internet, placing them behind a dedicated VPN or authenticated reverse proxy with strict inspection. Beyond patching, defensive monitoring should focus on RPC/HTTP capture-replay anomalies and unusual mailbox delegation or read patterns originating from internal service accounts.
The Quote to Remember
“The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.”
“Exchange Server 2016 and 2019 only receive security updates via the Extended Security Updates Program (ESU). Are you using one of these versions? If so, ensure that the server is accessible only internally and replace it if possible.”