#Microsoft Exchange

Nearly 22,000 Internet-Facing Exchange Servers Remain Exposed to Auth-Bypass Mailbox Hijacking Flaw

Telemetry from the Shadowserver Foundation indicates that approximately 21,899 internet-facing Microsoft Exchange servers remain vulnerable to a high-severity authentication bypass tracked as CVE-2026-62911. Discovered by security researcher Orange Tsai of DEVCORE at Pwn2Own Berlin 2026, the vulnerability netted a $200,000 bounty by demonstrating full system takeover capabilities. Microsoft subsequently issued patches for the flaw during the August 2026 Patch Tuesday cycle. The bug affects several core editions, specifically Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). An attacker holding basic authorized access on a network can leverage capture-replay techniques to elevate privileges across the environment. This flaw enables adversaries to commandeer all user mailboxes, allowing them to read communications, exfiltrate attachments, and dispatch emails under arbitrary identities. Public reporting from the Netherlands National Cyber Security Centre (NCSC-NL) and technical disclosures indicate that a functional Python-based proof-of-concept exploit is already circulating on GitHub. The available exploit chain demonstrates how this bug links with other weaknesses to compromise servers completely. In Germany, the Federal Office for Information Security (BSI) reported that approximately 85% of local on-premises installations have not yet implemented the fix. Geographic exposure mapping reveals the United States and Germany as the most affected regions, hosting roughly 6,200 and 5,100 vulnerable endpoints respectively. Fixed builds include Exchange Server 2016 CU23 (`15.1.2507.72`), Exchange 2019 CU14 (`15.2.1544.44`), Exchange 2019 CU15 (`15.2.1748.49`/`KB5121574`), and Exchange SE RTM (`15.2.2562.46`/`KB5121573`). Because legacy 2016 and 2019 platforms reached end-of-support in October 2025, operators must rely on the Extended Security Updates (ESU) channel to ingest these updates before support ends entirely.