Nearly 22,000 Exchange Servers Still Exposed to CVE-2026-62911 as Public PoC Lands

A patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program. has been available since August, a working proof-of-concept is now public, and roughly 22,000 Microsoft Exchange servers are still sitting on the internet unpatched. That combination is why CVE-2026-62911 has moved from a Pwn2Own demo to an operational problem that mail administrators need to close this week.

The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. is an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. in on-premises Exchange Server. Microsoft classifies it as an elevation-of-privilege issue, but the practical outcome is worse than that label suggests: an attacker who can reach the right endpoint can impersonate legitimate users and work toward full mailbox access without valid credentials. Microsoft's own summary is blunt about the stakes, stating that a successful attacker "would be able to take over the mailboxes of all Exchange users" and read, send, and download mail and attachments.

What Happened

CVE-2026-62911 was demonstrated at Pwn2Own Berlin 2026 and disclosed to Microsoft through Trend Micro's Zero Day Initiative, tracked in that program as ZDI-26-538. Microsoft published the advisory and shipped a fix as part of its August 2026 security updates, assigning the flaw a CVSS base score of 8.0 and categorizing it under CWE-294, authentication bypass by capture-replay.

The technical core is an internet-reachable MRSProxy endpoint, part of the Mailbox Replication Service, that fails to enforce Extended Protection for AuthenticationExtended Protection for Authentication🛡️A Windows security feature that binds an authentication token to the TLS channel it was issued on, so a token replayed on a different channel is rejected. It is the primary defense against NTLM relayNTLM Relay🛡️An attack where a valid NTLM authentication is forwarded in real time to a different service than the one intended, granting the attacker the victim's access without ever cracking a credential... Because that protection is missing, an attacker can relay NTLM authentication belonging to an Exchange machine accountMachine Account🛡️An Active Directory account that represents a computer or service rather than a person. Machine accounts often hold broad privileges, which makes them high-value targets for relay attacks. and effectively bypass the authentication check entirely. From there the path leads toward writing content into IIS directories and executing code in a highly privileged context. It is the same class of front-end proxy weakness that has made Exchange a recurring target for years.

In the days before September 1, proof-of-concept exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. code became publicly available. The Zero Day Initiative, which runs Pwn2Own, has publicly disputed Microsoft's characterization of the exploit maturity, arguing the flaw is more readily weaponizable than the vendor's rating implies. That disagreement matters for defenders deciding how urgently to act.

Who Is Affected

The flaw affects on-premises Exchange across the currently supported builds: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Exchange OnlineExchange Online🌐Microsoft's cloud-based email and calendaring service, part of Microsoft 365Microsoft 365🌐Microsoft's subscription-based cloud productivity suite including Office applications, Exchange Online, SharePoint, and Teams., that hosts mailboxes in Microsoft's data centers. is not the concern here; this is a self-hosted, internet-facing mail server problem.

Administrators should confirm they are running the fixed builds rather than assuming a recent cumulative update is enough. The patched builds are 15.1.2507.72 for Exchange 2016 CU23, 15.2.1544.44 for Exchange 2019 CU14, 15.2.1748.49 for Exchange 2019 CU15, and 15.2.2562.46 for the Subscription Edition. Verifying the exact build number is the only reliable way to know whether a server is protected.

The exposure numbers are the alarming part. Shadowserver's internet-wide scans counted 21,899 unique unpatched, internet-reachable Exchange instances as of August 31, 2026. The United States led with roughly 6,200 servers and Germany followed with about 5,100. Germany's federal cyber agency, the BSI, reported that an estimated 85 percent of on-premises Exchange servers in the country remained vulnerable, a figure that hints at how far behind patch cycles many organizations still are.

Technical Analysis

The reason this bug is dangerous is that a security control was optional where it should have been mandatory. Extended Protection for Authentication binds an authentication token to the specific TLS channel it was issued on, which is precisely what defeats a relay attack. When the MRSProxy endpoint does not enforce that binding, an authentication exchange captured from one context can be replayed against another. That is the capture-replay pattern CWE-294 describes, and it is why simply having strong passwords or even multi-factor authentication does not save an unpatched server: the attacker is not guessing credentials, they are reusing a machine account's own authentication.

Exchange's architecture compounds the risk. A machine account that can be relayed often holds significant privileges within the Exchange organization and the surrounding Active Directory environment, so a bypass at the mail tier can become a foothold for lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal. across the domain. Understanding how NTLM relay attacks bypass authentication makes clear why a single exposed endpoint is enough to matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility..

Immediate Actions

The first step is to apply the August 2026 security update and confirm the resulting build number against the fixed versions above. Patching is necessary but, for this class of flaw, not always sufficient on its own: Extended Protection for Authentication must actually be enabled and verified across the Exchange virtual directories, because the mitigation only works when it is turned on. Learning how to enable Extended Protection for Authentication on Exchange is the difference between a patched server and a protected one.

Beyond patching, reduce exposure. There is no good reason for the MRSProxy endpoint or the Exchange management interfaces to be reachable from the open internet. Restricting inbound access to trusted networks, deploying Microsoft's Exchange Emergency Mitigation service where applicable, and auditing privileged group membership all shrink the blast radius. Monitoring for anomalous NTLM authentication and for unexpected files appearing in IIS web directories will catch exploitation attempts that slip through.

Long-Term Outlook

The deeper lesson is that on-premises Exchange keeps generating this exact kind of headline. It is a large, complex, internet-facing application whose front-end proxies have repeatedly proven to be a rich attack surfaceAttack Surface🛡️The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching., and it now sits near the end of its supported life, with extended security updates for the 2016 and 2019 lines winding down. Every organization still running it is signing up to patch these flaws quickly, in perpetuity, or to accept standing risk. For many, the durable answer is to plan a migration off on-premises Exchange rather than to keep firefighting each new proxy vulnerability.

CVE-2026-62911 is not yet in CISA's Known Exploited Vulnerabilities catalog, which means confirmed in-the-wild exploitation had not been reported at the time of writing. With a public PoC and tens of thousands of exposed targets, that status is unlikely to hold. Treat the window between a public exploit and mass exploitation as short, and close it now.

Sources

• https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/
• https://cybersecuritynews.com/exchange-servers-remain-exposed-2026-62911/
• https://gbhackers.com/poc-released-for-microsoft-exchange-cve-2026-62911/
• https://securityarsenal.com/blog/cve-2026-62911-microsoft-exchange-privilege-escalation-via-improper-authorization-zdi-26-538-detection-and-remediation-guide
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-62911