← Back to blog

September 3, 2026 Vulnerability Research

CVE-2026-62911: Over 21,000 Exchange Servers Remain Exposed. How Should You Close the Gap?

Microsoft shipped the patch for CVE-2026-62911 on 11 August 2026. Three weeks later, working exploit code is circulating, and more than 21,000 internet-facing Exchange servers are still running without it. The flaw needs no valid credentials, and a successful attack hands over every mailbox on the server. The distance between a patch being available and a patch being applied is where this kind of attacker operates, and right now that distance is more than 21,000 servers wide.

CVE-2026-62911 is a critical authentication-bypass vulnerability in on-premises Microsoft Exchange Server, rated CVSS 8.0, that Microsoft addressed in its August 2026 security updates. An attacker who can reach an exposed server can relay its own machine-account authentication through an endpoint that fails to enforce Extended Protection, bypass authentication, and read or send mail from any mailbox. As of 31 August 2026, the Shadowserver Foundation counted 21,899 servers still exposed. The fix is to apply the August 2026 update for your exact build and enforce Extended Protection.

This guide is for anyone running Exchange on-premises and for the security leaders who have to answer whether their organization is exposed. It explains what the flaw is, how it leads to a full mailbox takeover, how many servers are still open and why, and the steps to check and close it. The wider point underneath it is that a patch you have not verified on the live system is not yet a fix, which is where external testing earns its place.

Table of Contents

Key Takeaways on CVE-2026-62911

Before the detail, the points below capture what a security leader needs to decide about CVE-2026-62911 today.

The flaw is critical and needs no credentials. CVE-2026-62911 is an authentication bypass rated CVSS 8.0 that, when chained, lets an unauthenticated attacker take over every mailbox on an affected Exchange server.
The patch has been out since 11 August 2026. Microsoft fixed it in the August 2026 security updates, so this is a patch-application problem rather than a wait-for-a-fix problem.
Exploit code is public. Researchers have released working proof-of-concept code, and the Netherlands national cyber agency raised the priority to high, which shortens the time before opportunistic scanning becomes exploitation.
More than 21,000 servers are still open. The Shadowserver Foundation counted 21,899 exposed servers on 31 August 2026, with the United States and Germany the most affected.
Extended protection helps but does not replace the patch. Enforcing Extended Protection blocks the relay this flaw depends on, and researchers are clear that the vendor update still has to be applied.

What is CVE-2026-62911?

CVE-2026-62911 is a critical authentication-bypass vulnerability in on-premises Microsoft Exchange Server, classified as authentication bypass by capture-replay under CWE-294 and rated CVSS 8.0. Microsoft disclosed it on 11 August 2026 as an elevation-of-privilege issue, describing a flaw where an attacker who can capture and replay authentication traffic impersonates a legitimate account and escalates privilege over the network. In the exploit chain researchers demonstrated, that bypass leads to a full takeover of the server’s mailboxes.

The flaw came out of security research. It was demonstrated at Pwn2Own Berlin 2026 by the researcher Orange Tsai of DEVCORE, reported through Trend Micro’s Zero Day Initiative, and formally patched in Microsoft’s August 2026 Patch Tuesday cycle. Trend Micro’s Zero Day Initiative publicly contested Microsoft’s initial exploit-maturity rating, and the release of public proof-of-concept code and a raised advisory from the Netherlands national cyber agency since then have borne out the concern that this is a practical, not a theoretical, risk.

How the Flaw Leads to a Full Mailbox Takeover

The takeover works because a single Exchange endpoint accepts authentication; it should refuse to trust. Exchange exposes an endpoint called the Mailbox Replication Service Proxy, or MRSProxy, used for moving mailboxes. On an affected server this endpoint accepts Negotiate authentication but does not validate channel bindings, which is the check that Extended Protection for Authentication enforces. Without that check in place, the authentication can be relayed rather than trusted only from its rightful source.

An attacker uses that gap to run a relay attack. An NTLM relay attack captures an authentication attempt from one system and replays it to another to impersonate the account that authenticated. Here the attacker coerces and relays the Exchange server’s own machine-account authentication to the MRSProxy endpoint, and the endpoint then treats the attacker as that account. Because the machine account is highly privileged, the result is access to every mailbox on the server, with the ability to read, send, and download attachments regardless of which user owns the mailbox, and no valid user credentials are needed to begin. This is a defensive description of a mechanism that is already public and being tracked by national agencies, and the point of understanding it is to know which control stops it.

How Many Servers Are Still Exposed, and Where

The scale of the exposure is what makes this urgent. The Shadowserver Foundation, a nonprofit that runs internet-wide scans, found 21,899 unique Exchange servers still exposed and unpatched as of 31 August 2026, drawn from daily full-internet IPv4 sweeps and IPv6 hitlist scans. The United States led with roughly 6,200 exposed servers, followed by Germany at about 5,100, with the United Kingdom, Russia, Canada, Austria, and France each reporting several hundred more and smaller clusters spread across many other countries.

That visibility is now continuous. Shadowserver has said it is reporting these vulnerable instances daily through its Vulnerable Exchange Server Report, which feeds national CERTs, including SingCERT in Singapore, a live view of unpatched systems in their jurisdictions. You can see the current counts in Shadowserver’s report. If your organization runs Exchange on-premises and has not confirmed its patch level, the realistic assumption is that a scanner has already found it, since these sweeps run every day.

Which Exchange Versions Are Affected, and the Fixed Builds

Exchange version	Vulnerable update	Patched build (August 2026)
Exchange Server 2016	Cumulative Update 23	15.1.2507.72
Exchange Server 2019	Cumulative Update 14	15.2.1544.44
Exchange Server 2019	Cumulative Update 15	15.2.1748.49
Exchange Server Subscription Edition	RTM baseline	15.2.2562.46

The affected products are the supported on-premises Exchange lines, and the fix is a specific build rather than a general update. The table below pairs each affected version with the build that closes CVE-2026-62911, delivered through the August 2026 security updates. Two details decide whether a server is actually protected. The exact build number is what matters, so a server on the right cumulative update but an earlier sub-version than the August 2026 build remains exploitable. And Exchange Server 2016 and 2019 now receive security updates only through the Extended Security Updates program, so organizations still on those versions have to be enrolled to get the fix, which the Netherlands national cyber agency has paired with the advice to keep such servers internal-only or replace them.

Why On Premises Exchange Keeps Landing on These Lists

On-premises Exchange keeps appearing in mass-exposure reports because it combines high value with a large, internet-facing footprint that is slow to patch. An Exchange server holds an organization’s email, which is both sensitive in itself and a route to password resets, financial approvals, and onward access, so it is a target worth an attacker’s time. It also sits on the perimeter by design, which means a flaw in the wrong endpoint is reachable from anywhere.

The patch lag is the other half. Exchange updates can be operationally disruptive, cumulative updates and build number confusion lead teams to believe they are covered when they are not, and the shift of Exchange 2016 and 2019 to Extended Security Updates leaves some organizations receiving no fixes at all. The result is a recurring pattern where a serious Exchange flaw is patched, a proof-of-concept follows within days, and tens of thousands of servers stay exposed for weeks. Knowing your external footprint is the only way to avoid being one of them, which is the same discipline behind what MAS auditors look for in your identity and access architecture, where vendor and internet-facing access is a standing question.

How to Check Whether Your Exchange is eEposed

Checking your exposure to CVE-2026-62911 comes down to confirming your build and confirming your perimeter. Both are quick, and both are places where an assumption tends to hide the truth.

Verify the exact build number of every Exchange server, not only the cumulative update, and compare it against the August 2026 patched build for that version. A server one sub-version behind is still vulnerable.
Confirm whether the MRSProxy endpoint and other Exchange web endpoints are reachable from the internet, since the flaw depends on that reachability.
Check whether Extended Protection for Authentication is enforced across your Exchange endpoints, because its absence is the condition the attack requires.
Review your national CERT and Shadowserver reporting for your own IP ranges, which will show whether your servers are already flagged as exposed.
Treat any Exchange 2016 or 2019 server as higher risk, confirm whether it is enrolled in Extended Security Updates, and question whether it should be internet-facing at all.

How to Remediate CVE-2026-62911?

Remediating CVE-2026-62911 takes three moves: apply the August 2026 security update for your exact Exchange build, restart the affected services, and enforce Extended Protection for Authentication with TLS 1.2 or higher. The update is the fix, and the hardening steps close the specific relay path and reduce the blast radius of related flaws.

Apply the vendor update first, matching the patched build for your version from the table above, and confirm the build number after the update rather than assuming the installer succeeded. Enforce Extended Protection for Authentication across your Exchange endpoints, since that is the control that blocks the channel-binding gap this flaw abuses, and researchers are explicit that it strengthens the patch rather than replacing it. Require TLS 1.2 or higher, and monitor for anomalous NTLM relay activity and unexpected authentication from machine accounts, which are the signals of an attempt in progress. For Exchange 2016 and 2019, confirm Extended Security Updates enrollment, restrict the server to internal access where possible, and plan a migration off a platform that is now on borrowed time.

The Pattern Behind the Exposure: The Patch Window is Shrinking

The deeper lesson of CVE-2026-62911 is that the time between a patch and a working exploit keeps getting shorter, so a slow patch cycle is now a real exposure rather than a tolerable delay. Here the vulnerability was demonstrated at a public competition, patched on a Tuesday, and followed by public proof-of-concept code within weeks, with a national agency raising its priority to high. An organization that patches on a monthly or quarterly rhythm is exposed for the whole of that window while attackers scan daily.

Singapore’s own regulator has made the same point in stronger terms. The Cyber Security Agency of Singapore issued an advisory in April 2026 warning that frontier AI models can cut the time to find a vulnerability and build an exploit from months to hours, and it recommended patching internet-facing systems quickly, enforcing multi-factor authentication, and applying least-privilege access as immediate steps. The through-line is that perimeter services have to be inventoried continuously and patched fast, and that the assumption of a comfortable patch window no longer holds.

How to Remediate CVE-2026-62911?

The Pattern Behind the Exposure: The Patch Window Is Shrinking

How Penetration Testing Closes the Gap?

Penetration testing and external attack-surface assessment close the gap by finding the exposed, unpatched, and misconfigured services on your perimeter before an attacker’s scanner does and by confirming that a patch actually took effect on the live system. A build number in a change ticket is a claim. A test against the running server is evidence, and for a flaw like this one, the difference is whether Extended Protection is enforced on the endpoint that matters or only assumed to be.

The quality of that assessment depends on how it is run. A scanner reports known signatures, and it will not always tell you whether a relay path is still reachable or whether one server among many was missed in the rollout, because that is a question about how your systems authenticate and trust one another. Answering it takes a person who reasons through the attack path, reproduces the weakness, and puts a name to the finding. CredShields runs this as human-led testing where every finding is reproduced and verified and the report carries a named assessor, and the same report supports a compliance program, in the way we describe in SOC 2 penetration testing and what you should expect before an audit. The questions worth asking a prospective firm are set out in our guide to what to know before choosing a penetration testing vendor. If confirming that your internet-facing services are patched and hardened is the gap, you can scope a penetration test against your external attack surface.

Recommended read: the broken access control flaw CredShields found in Google’s Site Kit, on what it looks like when a researcher reproduces a real CVE end-to-end.

Frequently Asked Questions (FAQs) About CVE-2026-62911

The questions below cover what security and IT teams ask most often about CVE-2026-62911.

Q1. What is CVE-2026-62911?

CVE-2026-62911 is a critical authentication-bypass vulnerability in on-premises Microsoft Exchange Server, rated CVSS 8.0 and tracked under CWE-294. Microsoft disclosed it on 11 August 2026, and when chained, it lets an attacker bypass authentication and take over every mailbox on an affected server.

Q2. How serious is it?

It is serious. The flaw needs no valid credentials, a public proof-of-concept exploit exists, and a successful attack gives read and send access to all mailboxes on the server. The Netherlands national cyber agency raised its advisory priority to high, and more than 21,000 servers were still exposed at the end of August 2026.

Q3. Is CVE-2026-62911 being exploited?

Public proof-of-concept exploit code is circulating, which typically precedes opportunistic scanning and exploitation. Whether or not widespread exploitation is confirmed, the combination of a public exploit and tens of thousands of exposed servers makes prompt patching the only safe assumption.

Q4. Which Exchange versions are affected?

Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14 and 15, and Exchange Server Subscription Edition. Each has a specific patched build in the August 2026 security updates, and only that exact build closes the flaw.

Q5. How do I fix CVE-2026-62911?

Apply the August 2026 security update for your exact Exchange build, restart the affected services, and enforce Extended Protection for Authentication with TLS 1.2 or higher. Confirm the build number after patching rather than assuming the update succeeded.

Q6. Does enabling Extended Protection fix it on its own?

No. Enforcing Extended Protection blocks the relay the flaw depends on and is strongly recommended, but researchers are clear that it does not replace the vendor patch. Both the update and the hardening should be in place.

Q7. How do I know if my server is still vulnerable after patching?

Check the exact build number against the August 2026 patched build, since a server on the right cumulative update but an earlier sub-version is still exploitable. An independent test against the live server confirms whether the patch and Extended Protection are in effect.

Q8. What if I am running Exchange 2016 or 2019?

Those versions now receive security updates only through the Extended Security Updates program, so confirm your enrollment to receive the fix. National guidance is to keep such servers internal-only where possible and to plan a migration, since they are reaching the end of supported life.

Q9. Why do so many Exchange servers stay unpatched?

Exchange updates can be operationally disruptive, build-number confusion leads teams to believe they are covered when they are not, and some organizations no longer receive fixes without Extended Security Updates enrollment. Together these produce the recurring pattern of tens of thousands of servers exposed for weeks after a patch.

Q10. How can we get ahead of the next Exchange flaw?

Maintain a continuous inventory of internet-facing services, patch the perimeter quickly rather than on a fixed cycle, enforce strong authentication, and validate the state of those systems with regular external testing. The patch window is shrinking, so continuous visibility matters more than any single fix.

Note: this article describes a live, actively tracked vulnerability at a defensive level. If you run Exchange on-premises and cannot confirm your patch status, treat it as urgent and prioritize the remediation steps above.