Why CWE-294 Replay Flaws Keep Appearing in Enterprise Messaging

CVE-2026-62911 in Microsoft Exchange Server is an authentication bypass by capture-replay, classified as CWE-294 with a CVSS 3.1 base score of 8.0 and patched on 11 August 2026. The class of flaw is older than the product.

What CWE-294 actually means

Authentication bypass by capture-replay means the system accepts authentication material that was valid in an earlier session and treats it as valid in a new one. The vulnerability is not a cryptographic break. It sits in the binding between the credential presentation and the session context.
Security engineering usually places three defenses against replay: unique session identifiers, nonces that expire with the session, and channel bindings that tie the material to a specific connection. Replay becomes possible when a code path skips one of them, or when the material still satisfies the check in a context it never belonged to.

Why messaging platforms are a natural habitat

Enterprise messaging systems carry a wide range of client protocols. MAPI, Exchange Web Services, ActiveSync and Outlook on the web each have their own authentication flow, and they share identity back ends. That variety creates more code paths than a single-protocol service, and each path that handles authentication is a place where a binding can be missed.
Legacy protocol support adds pressure. Where an older client flow must keep working, the modern hardening that would break it stays out. Replay is often the residual flaw in a compatibility decision.

The current case

CVE-2026-62911 affects Exchange Server 2016 Cumulative Update 23, 2019 Cumulative Update 14 and 15, and Subscription Edition RTM. Microsoft's advisory describes an authorized attacker elevating privileges over a network. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
| Product | Affected from | Fixed below |
| --- | --- | --- |
| Exchange Server 2016 Cumulative Update 23 | 15.01.0.0 | 15.01.2507.072 |
| Exchange Server 2019 Cumulative Update 14 | 15.02.0.0 | 15.02.1544.044 |
| Exchange Server 2019 Cumulative Update 15 | 15.02.0.0 | 15.02.1748.049 |
| Exchange Server Subscription Edition RTM | 15.02.0.0 | 15.02.2562.046 |

What the pattern implies for defenders

A replay flaw will not show up as a burst of failed logins. It shows up as a successful login from an unusual location, so detection programs built around failure volume will miss it, while programs built around successful-authentication context will catch more of it.
On the prevention side, moving authentication toward phishing-resistant methods narrows what a captured exchange is worth. Segmenting the network path between clients and mail servers also reduces the number of vantage points an attacker can use to observe traffic.

The exposure backdrop

CSIRT.CZ reported roughly 22,000 internet-reachable Exchange servers that had not been patched, and that a public exploit is available. A ZoomEye query on app="Microsoft Exchange" returns 569453 matching assets globally. The vul.cve="CVE-2026-62911" filter returned 0, since ZoomEye has not indexed the identifier against observed assets yet.

Where this points

Replay flaws are a recurring class rather than a one-off defect. Treating a successful authentication as an event that deserves context, rather than a pass or fail, is the durable answer.