Nearly 22,000 Microsoft Exchange Servers Vulnerable to Mail Hijacking

About 22,000 internet-facing Microsoft Exchange servers are still unprotected against a dangerous vulnerability that lets an attacker bypass authentication and take control of every user's mailbox.

The vulnerability

The flaw, tracked as CVE-2026-62911, was discovered by Orange Tsai of the DEVCORE research team. It affects Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition. To exploit it, an attacker needs only basic privileges on the server, and the attack is low in complexity, though it does require user interaction.

By Microsoft's description, this is a capture-replay authentication bypass that allows privilege escalation over the network. Once in, an attacker can take over the mailboxes of all Exchange users: reading and sending mail, and downloading attachments. Microsoft shipped the patch as part of its August 2026 Patch Tuesday.

The exploit is already public

The Netherlands' National Cyber Security Centre (NCSC-NL) reported last week that exploit code for the vulnerability is already circulating online, and urged that updates be installed as soon as possible. An added complication is that Exchange Server 2016 and 2019 only receive security updates through the Extended Security Updates (ESU) program. For those versions, NCSC-NL recommends restricting server access to the internal network and replacing it where possible.

According to the Shadowserver group, as of Tuesday there were 21,899 IP addresses running unpatched Exchange servers online. The most are in the US (about 6,200) and in Germany (about 5,100). Germany's Federal Office for Information Security (BSI) added that roughly 85% of all on-premises Exchange servers in the country remain vulnerable.

Exchange as a chronic headache

So far CVE-2026-62911 is not counted among vulnerabilities exploited “in the wild,” but Exchange has a rich history of trouble. In June, Microsoft closed another flaw, CVE-2026-42897, which had already been used in XSS attacks against Outlook Web Access users; CISA added it to its catalog of actively exploited vulnerabilities and ordered US government agencies to remediate it within two weeks. Since November 2021, 20 Exchange vulnerabilities have made it into that catalog, 14 of which were used in ransomware attacks.

The situation is compounded by the retirement of the 2016 and 2019 versions: their support has ended, and the delivery of security updates through the ESU program will stop in October 2026. Last fall, CISA and the NSA issued joint guidance on hardening Exchange servers — against the backdrop of many organizations still leaving vulnerable systems open to the entire world.

Source: Bleeping Computer