CVE-2026-62911 Exposed: Why 21,899 Microsoft Exchange Servers Are Still Sitting Ducks
Picture a mid-sized manufacturing firm in Ohio. Their IT team patched their firewalls, rotated admin passwords, even ran a phishing simulation last quarter. But their on-premises Exchange server — the one hosting every executive's inbox, every vendor contract, every HR email — hasn't seen a cumulative update since spring. That server is one of an estimated 21,899 Exchange instances currently exposed to CVE-2026-62911, a critical authentication-bypass vulnerability that Microsoft patched a full month ago and almost nobody applied in time.
This isn't a hypothetical. It's the exact scenario the Shadowserver Foundation's daily internet scans are quietly documenting right now, and it's a pattern every SOC analyst has seen before: patch ships, headlines fade, exposure lingers.
Table of Contents
- What Happened: The CVE-2026-62911 Timeline
- Technical Breakdown: How the Bypass Actually Works
- Who's Exposed: The Shadowserver Numbers
- Detection: How to Check If You're Vulnerable
- Prevention & Remediation Steps
- Expert Tips From the SOC Trenches
- Related Reading
- FAQ
- Conclusion
What Happened: The CVE-2026-62911 Timeline
On August 11, 2026, Microsoft disclosed CVE-2026-62911 as part of that month's Patch Tuesday rollup. Microsoft classifies it as an authentication bypass by capture-replay (CWE-294), carrying a CVSS score of 8.0. In plain terms: an attacker who can intercept and replay authentication traffic can impersonate a legitimate user and escalate privileges inside Exchange Server — without ever knowing that user's actual password.
The bug was originally demonstrated months earlier at Pwn2Own Berlin 2026 by Orange Tsai of the DEVCORE Research Team, working through Trend Micro's Zero Day Initiative (ZDI). Notably, ZDI has publicly pushed back on Microsoft's exploit-maturity rating, arguing the real-world risk is understated. That kind of disagreement between a vendor and the researchers who found the bug is worth paying attention to — it usually means the practical exploitation path is easier than the advisory language suggests.
Three weeks after the patch shipped, the Netherlands' National Cyber Security Centre (NCSC-NL) confirmed that working exploit code for the vulnerability was circulating publicly. That's the moment a "patch it when you can" advisory turns into a "patch it today" emergency.
Technical Breakdown: How the Bypass Actually Works
The root cause traces back to Exchange's MRSProxy (Mailbox Replication Service Proxy) endpoint — a component that's often internet-reachable on hybrid and on-prem deployments. Reports indicate MRSProxy fails to enforce Extended Protection for Authentication (EPA), which normally binds an authentication session to a specific TLS channel to prevent replay and relay attacks.
Without that enforcement, an attacker positioned to intercept NTLM authentication traffic can relay credentials belonging to the Exchange machine account itself — effectively walking past authentication entirely. From there, the path opens toward full mailbox compromise: reading, sending, and downloading attachments across every mailbox hosted on that server.
This matters because it's not a theoretical privilege-escalation footnote. It's a direct line from "attacker on the network" to "attacker owns your entire email environment," which is exactly the kind of access that fuels business email compromise (BEC), invoice fraud, and lateral movement into connected systems.
| Exchange Server Version | Vulnerable Cumulative Update | Patched Build (August 2026) |
|---|---|---|
| Exchange Server 2016 | Cumulative Update 23 | 15.1.2507.72 |
| Exchange Server 2019 | Cumulative Update 14 | 15.2.1544.44 |
| Exchange Server 2019 | Cumulative Update 15 | 15.2.1748.49 |
| Exchange Server Subscription Edition | RTM Baseline | 15.2.2562.46 |
One detail administrators consistently overlook: being on the "right" cumulative update is not the same as being patched. A server can run CU23 and still be vulnerable if the specific August 2026 security update hasn't been applied on top of it. Build number verification, not CU version alone, is the only reliable check.
Who's Exposed: The Shadowserver Numbers
According to Shadowserver Foundation's daily IPv4 full-internet sweeps and IPv6 hitlist scans, exactly 21,899 unique IP addresses were fingerprinted as vulnerable as of August 31, 2026. Exposure is heavily concentrated but genuinely global:
- United States — roughly 6,200 vulnerable instances
- Germany — roughly 5,100 vulnerable instances
- Several hundred additional exposed servers each in the United Kingdom, Russia, Canada, Austria, and France
- Smaller clusters across Italy, the Netherlands, China, and dozens of other countries
Germany's national picture is especially stark: the Federal Office for Information Security (BSI) stated on August 28, 2026 that roughly 85 percent of on-premises Exchange servers in the country remain vulnerable. That's not a niche gap — that's the overwhelming majority of a national installed base sitting exposed weeks after a fix existed.
As of this writing, neither Microsoft nor CISA's Known Exploited Vulnerabilities catalog has confirmed active in-the-wild exploitation. That distinction matters for accurate risk communication — public exploit code and confirmed compromise are two different things, and conflating them helps no one. But history with Exchange (ProxyShell, ProxyNotShell, ProxyLogon) shows the gap between "PoC published" and "mass scanning begins" is often measured in days, not months.
Detection: How to Check If You're Vulnerable
Start with the build number, not the cumulative update label. On the Exchange server, run:
Get-ExchangeServer | ft Name, Edition, AdminDisplayVersionWhat it does: Returns the exact build number installed on each Exchange server in your environment. When to use it: Immediately, as your first triage step, before assuming a CU-level patch means you're covered. Expected output: A version string like 15.2.1748.44 — compare this directly against the patched builds table above; anything below the listed patched build is exploitable.
Next, check whether MRSProxy is internet-reachable at all — it often shouldn't be:
Get-WebServicesVirtualDirectory | fl Server, Name, InternalUrl, ExternalUrlWhat it does: Lists the virtual directories tied to Exchange Web Services, including the paths MRSProxy rides on. When to use it: As part of an external attack-surface review, ideally paired with an actual internet-facing port scan of your Exchange IP. Expected output: Internal and external URLs for each server — flag any externally reachable endpoint that doesn't have a documented business need to face the internet.
From a SOC monitoring angle, watch for anomalous NTLM authentication patterns — repeated authentication attempts against MRSProxy from unusual source IPs, or authentication traffic that doesn't align with normal mailbox-migration or hybrid-sync activity, which is MRSProxy's legitimate use case.
Prevention & Remediation Steps
- Apply the August 2026 security update matching your exact CU, verified by build number — not by assumption.
- Restart affected services after patching; a partially applied update with services still running old binaries provides no protection.
- Enforce TLS 1.2 or higher across Exchange endpoints to reduce the viable window for traffic interception.
- Restrict internet exposure of MRSProxy and related endpoints where there's no operational need for external reachability — NCSC-NL's guidance for organizations that can't patch immediately is to make the server internally accessible only.
- Confirm ESU enrollment if you're running Exchange 2016 or 2019 — mainstream security updates for these versions are only available through the Extended Security Updates program, which is scheduled to end in October 2026.
- Monitor for NTLM relay indicators and unusual authentication replay patterns as an ongoing detection layer, not just a one-time check.
None of these steps guarantee complete protection against every future variant of this attack class, but together they close the specific exposure Shadowserver is currently measuring.
Expert Tips From the SOC Trenches
In practice, the organizations that get burned by vulnerabilities like this aren't the ones without a patch management process — they're the ones whose process doesn't distinguish between "patch available" and "patch verified applied." Build-number verification should be a standing item in your monthly vulnerability review, not something that only happens after a CVE makes headlines.
It's also worth treating externally reachable Exchange components as a standing architectural question, not a one-off firefighting exercise. Every internet-facing endpoint on a mail server is a future CVE waiting for a name. Where a hybrid or cloud migration path exists, it's worth evaluating on its own timeline, independent of any single vulnerability disclosure.
Related Cybersecurity Topics You Should Explore
- WordPress Now Uses AI to Catch Security Flaws Before Hackers Do
- Mini Shai-Hulud Worm Hits npm Package With 150K Weekly Downloads
- more vs less Linux Commands: The SOC Analyst's Log Review Guide
- JFrog Artifactory Hacked: Attackers Are Minting Admin Tokens
- tail -f Explained: The Linux Command That Beats Your SIEM's Delay
- Brave Browser Now Hides Your Real Email From Every Website
- D-Link Router Flaw Lets Hackers Steal Your Wi-Fi Password
- 'This Blog Has Been Locked' — How to Backup Blogger the Right Way
- cPanel Zero-Day Lets Hackers Seize Root Control of Your Server
- TP-Link Kasa Vulnerability Lets Hackers Hijack Your Smart Home Devices
- CVE-2026-16444: The TeamViewer Bug That Turns File Transfer Into RCE
- Hackers Weaponize Fake Resumes to Hijack PCs Silently
- 8.7M Airport Customers Breached — Are You One of Them?
- Claude Code Opus 5 Auto Mode Hijacked via Prompt Injection Attack
- A Broken Bluetooth Headset Exposed AliExpress's Secret Tracker
Frequently Asked Questions
Is CVE-2026-62911 being actively exploited right now?
As of this writing, Microsoft has not confirmed active in-the-wild exploitation, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog at publication time. However, working exploit code is publicly available, which historically shortens the window before opportunistic scanning turns into real attacks.
Does this affect Exchange Online (Microsoft 365)?
No. This vulnerability affects locally operated, on-premises Exchange Server deployments. Exchange Online is not affected.
What's the actual CVSS severity?
Microsoft rates CVE-2026-62911 at 8.0, categorized as high severity.
My server is on Exchange 2019 CU15 — am I automatically safe?
Not automatically. Being on CU15 only matters if you've also applied the specific August 2026 security update (build 15.2.1748.49). Verify the exact build number rather than relying on the CU label alone.
What happens after Exchange 2016/2019 ESU ends in October 2026?
Once Extended Security Updates end, those versions will stop receiving security fixes altogether, making unmigrated environments a growing long-term risk independent of any single CVE.
Are there compliance implications for exposed mailbox data?
Organizations operating in the EU handling personal data may face reporting obligations under GDPR Article 33 if mailbox contents are compromised, and NIS 2 may impose additional sector-specific reporting requirements. This is general awareness, not legal advice — consult your compliance and legal teams for your specific obligations.
Conclusion
CVE-2026-62911 is a reminder of a pattern security teams know all too well: the patch existing isn't the same as the risk being closed. With nearly 22,000 Exchange servers still exposed a month after the fix shipped, and public exploit code already circulating, the gap between "patched in theory" and "patched in practice" is exactly where real incidents happen.
If you're running on-premises Exchange, don't wait for a confirmed breach headline to check your build number. Verify it today, restrict what doesn't need to face the internet, and treat this as the priority patch-management item it is.
Found this useful? Share it with your team, and drop a comment if you've run into MRSProxy or NTLM relay issues in your own environment — real-world detection stories help everyone in this field.