45,644 Exchange Servers on HTTP: Measuring a Mail Tier That Cannot Be Hidden

Mail servers are the one service an organisation cannot place behind a private network, because the whole point is to accept connections. That makes measurement of the mail tier unusually informative rather than merely routine.

The measurement

ZoomEye queries executed on 1 October 2026 at 02:33 UTC, global scope and all asset types:
| Query | Matching assets |
| --- | ---: |
| app="Microsoft Exchange" | 568,957 |
| app="Microsoft Exchange" && service="http" | 45,644 |
The two numbers describe different populations, and the gap is large. A fingerprint match can include components discovered through related evidence, while the HTTP-scoped query requires an observed HTTP service. Treating either figure as a count of installed Exchange servers would be a mistake, and treating the HTTP-scoped figure as a count of externally reachable mail roles is closer to useful.

The comparison that matters

Reporting from early September 2026 described approximately 22,000 Exchange servers still running a version affected by CVE-2026-62911, with Germany identified as the highest-risk region in that dataset, and noted that the same sources track 20 Exchange vulnerabilities in CISA's Known Exploited Vulnerabilities catalog since November 2021, 14 of them linked to ransomware.
An independent exposure count does not confirm or contradict that figure because the queries differ. What it does confirm is direction: Exchange is present on the public internet in quantities that make a version-based advisory expensive to close out manually.

Operational use

• Scope the same query to owned address ranges. For most organisations the answer should be a short, known list. An unexpected entry is either an inherited server or a shadow deployment, and both are patch problems.
• Distinguish client-facing roles from internal transport. The count that matters for an external advisory is the reachable one.
• Prioritise by build, not by service name. The Exchange version determines which advisories apply, and the exposure count only tells you where to look.
• Track the trend. A count that rises between snapshots means something was published that should not have been.

Product context

ZoomEye records more than a service banner for a host. Certificate subjects, HTTP headers and response features are the fields that allow an operator to separate an internet-facing Exchange deployment from a residual fingerprint, and to compare that finding with the internal build inventory the patching process depends on. The measurement answers a question internal records answer poorly, which is what is actually answering on the network from outside the organisation. It does not tell anyone whether a specific server is vulnerable, and it should never be presented as if it did.

References

1. "22,000 Exchange servers worldwide remain unpatched", 2 September 2026, https://view.inews.qq.com/wxn/20260902A09KSI00
2. CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
3. ZoomEye measurement, queries executed 1 October 2026 at 02:33 UTC, https://www.zoomeye.ai/