Public exploit code for CVE-2026-62911 is outpacing patching on 21,899 exposed Exchange servers
Microsoft patched the Exchange authentication bypass on August 11. Shadowserver's September 1 scan still counts 21,899 internet-facing servers unpatched, and NCSC-NL says working exploit code for full mailbox takeover is circulating.
The Watch · Security desk
What happened
- Microsoft shipped the fix for CVE-2026-62911, an Exchange authentication bypass reported by DEVCORE's Orange Tsai, on August 11, 2026, covering Exchange Server 2016, 2019 and Subscription Edition.
- Microsoft says a successful attacker takes over the mailboxes of all Exchange users on the server, reading and sending mail and downloading attachments.
- Germany's BSI posted on August 28 that around 85 percent of on-premises Exchange servers in the country are still vulnerable to the flaw.
Why it matters
- What it limits constraint For Exchange 2016 and 2019 operators, patching stops being an option in October 2026 when Period 2 Extended Security Updates end, leaving network isolation or replacement as the remaining controls.
- Who's exposed exposure Because the bug needs basic privileges and user interaction rather than a pre-auth path, the exposed set is any organisation where one low-privilege mailbox or one cooperative user can be obtained.
- What it sets up precedent Fourteen of the 20 Exchange bugs on CISA's exploited list were also tied to ransomware, so an unpatched population this size historically ends in a KEV entry and a federal deadline rather than in quiet obsolescence.
- What doesn't add up contradiction Help Net Security labels the flaw critical while Zscaler and BleepingComputer call it high-severity on the same CVSS 8.0, which changes where it lands in a triage queue even though the score is identical.
Next story · Leadership · 2d ago
Microsoft's October release of 1,407 CVEs tops 2020's full-year record by 146Confirmed23 publishers
Capture-replay is the mechanism. It sets the entry price. Microsoft's wording is that an authorized attacker elevates privileges over a network [9], and BleepingComputer's read of the advisory adds low attack complexity plus a user interaction requirement, with the attacker holding basic privileges on the target [13]. Exploitation starts from a foothold, not from a blank internet scan. The payoff is what makes that foothold worth buying: read and send access across every mailbox on the server, attachments included [11].
The counting deserves care, because two numbers are being read as one. Shadowserver counts IP addresses carrying an Exchange fingerprint that are unpatched and reachable [2]. The United States and Germany contribute 6,200 and 5,100 [4], which is 11,300 between them, or 51.6 percent of the total [16]. Germany's BSI posted on August 28 that about 85 percent of the country's on-premises Exchange servers remain vulnerable [15], a measurement of all installs rather than the internet-facing subset. Forcing the two together would put Germany's exposed fleet near 6,000 [21]; the numbers add up, but they are counting two different populations.
The timeline matters too. From the August 11 fix [1] to Shadowserver's September 1 figure [3] is 21 days [20]. Exchange 2016 and 2019 receive these updates only through the Period 2 ESU program, which stops shipping in October 2026 [6]. That is roughly two months after this patch [17], so for two of the three affected versions the patch route closes well before the unpatched population is likely to move. NCSC-NL writes its guidance on that assumption, telling 2016 and 2019 operators to keep the server reachable only internally and to replace it where possible [7].
Zscaler's post on the bug, which recommends its own private access product [24], hangs the urgency on frontier AI models generally and on its own report's claim that mean-time-to-exploit has gone negative [24]. That framing borrows its urgency from Zscaler's broader trend claims rather than from anything confirmed about this specific bug. NCSC-NL says working exploit code is already circulating [5], Microsoft's advisory has not confirmed it [5], and CISA had not reported in-the-wild exploitation at the time of Zscaler's writing [14]. The operative question is who already holds a low-privilege mailbox on one of these servers rather than who can write the exploit, and OWA needing to be reachable by design keeps that population large [19].
The campaign history is the reason to read the gap as a schedule rather than a severity score. CISA has added 20 Exchange Server vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021, 14 of them also flagged as abused in ransomware [18]. The most recent, CVE-2026-42897, was exploited in cross-site scripting attacks against Outlook Web Access users and patched in June [10].
What to watch
- Whether CISA adds CVE-2026-62911 to the Known Exploited Vulnerabilities catalog, which would attach a fixed federal patch deadline.
- Whether Shadowserver's daily count bends downward before the October 2026 ESU cutoff, or plateaus near 22,000.
- Whether Microsoft updates its advisory to acknowledge public exploit code or exploitation in the wild.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption30
- Hype gap+18
- Incentives70
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 20%
- Operator
- Operator 68%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft released the fix for CVE-2026-62911 on August 11, 2026, as part of the August 2026 Patch Tuesday.
- [2]
Shadowserver warned on Tuesday that 21,899 IP addresses with a Microsoft Exchange Server fingerprint remain unpatched and exposed online.
- [3]
As of September 1, Shadowserver had identified around 22,000 Exchange servers still unpatched and exposed to the internet.
- [4]
Of the unpatched exposed servers, roughly 6,200 are in the United States and 5,100 in Germany.
- [5]
NCSC-NL reported that working exploit code for CVE-2026-62911 is already available online, and Microsoft has not updated its advisory to confirm this.
- [6]
Exchange Server 2016 and 2019 are out of support; only customers enrolled in the Period 2 Extended Security Update program receive updates released between May and October 2026, and ESU ends in October 2026.
- [7]
NCSC-NL advises installing the updates as soon as possible and, for Exchange 2016 and 2019 users, ensuring the server is accessible only internally and replacing it if possible.
- [8]
CVE-2026-62911 affects Microsoft Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition.
- [9]
Microsoft describes CVE-2026-62911 as "authentication bypass by capture-replay in Microsoft Exchange Server" allowing an authorized attacker to elevate privileges over a network.
- [10]
Microsoft patched CVE-2026-42897 in June, an Exchange flaw exploited in cross-site scripting attacks targeting Outlook Web Access users; CISA added it to the KEV catalog on May 15 and ordered federal agencies to patch within two weeks.
- [11]
Microsoft states the attacker would be able to take over the mailboxes of all Exchange users, and can send emails, read emails, and download attachments.
- [12]
The flaw was reported by Orange Tsai of the DEVCORE Research Team, working with Trend Micro's Zero Day Initiative.
- [13]
Threat actors with basic privileges on the targeted server can exploit CVE-2026-62911 in low-complexity attacks that require user interaction.
- [14]
Zscaler noted that at the time of writing, CISA had not reported exploitation of CVE-2026-62911 in the wild.
- [15]
Germany's Federal Office for Information Security (BSI) wrote on Mastodon on August 28, 2026, that around 85 percent of on-premises Exchange servers in the country remain vulnerable to CVE-2026-62911.
- [16]
The United States and Germany together account for 11,300 of the 21,899 unpatched exposed servers, or 51.6 percent.
- [17]
The October 2026 end of Extended Security Updates for Exchange 2016 and 2019 falls roughly two months after the August 11, 2026 fix for CVE-2026-62911.
- [18]
Since November 2021, CISA has added 20 Microsoft Exchange Server vulnerabilities to its Known Exploited Vulnerabilities catalog, 14 of them also flagged as abused in ransomware attacks.
- [19]
On-premises Exchange runs as an internet-facing service by design because Outlook Web App must be reachable by users, which typically means reachable from the public internet.
- [20]
Shadowserver's September 1 count comes 21 days after Microsoft shipped the fix on August 11, 2026.
- [21]
If BSI's 85 percent figure were applied to the 5,100 unpatched internet-facing German servers, it would imply a German exposed fleet of about 6,000.
- [22]
Zscaler describes CVE-2026-62911 as a high-severity authentication bypass with a CVSS score of 8.0 from Microsoft.
- [23]
Help Net Security describes CVE-2026-62911 as a critical severity vulnerability, while citing the same CVSS 8.0 score reported by NCSC-NL.
- [24]
Zscaler's post recommends its Zscaler Private Access product to remove Exchange from internet exposure, and argues the window between disclosure and exploitation has compressed because frontier models such as Anthropic's Mythos can build and run exploits in minutes, citing its ThreatLabz 2026 report claim that mean-time-to-exploit has gone negative.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
1 article · September 1, 2026
- helpnetsecurity.comNearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
1 article · September 2, 2026
- zscaler.comMicrosoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
1 article · September 3, 2026
Topics and entities
Topics
- AI-Assisted Exploitation
- Public exploit code and disclosure timing
- Patch lag on internet-exposed servers
- End-of-support and extended security updates
- Microsoft Exchange Server security
- Zero trust access to private applications
Entities
- Shadowserver Foundation
- Microsoft
- Exchange Extended Security Update program
- ThreatLabz 2026 Frontier AI Readiness Report
- Zscaler Private Access
- Mythos (preview)
- DEVCORE Research Team
- Trend Micro Zero Day Initiative
- Zscaler
- Federal Office for Information Security (BSI)
- Known Exploited Vulnerabilities catalog
- CISA
- Netherlands National Cyber Security Centrum
- Microsoft Exchange Server