If you manage on-prem Microsoft Exchange, this one's worth five minutes of your time.
On August 11, 2026, Microsoft disclosed CVE-2026-62911 — a critical authentication bypass vulnerability (CVSS 8.0) affecting Exchange Server 2016, 2019, and Subscription Edition. The root cause sits in Exchange's MRSProxy endpoint, which fails to enforce Extended Protection for Authentication. That gap lets an attacker relay NTLM credentials from the Exchange machine account and bypass authentication entirely — a direct path to full mailbox compromise.
Microsoft shipped patched builds the same day. A month later, Shadowserver Foundation's daily internet-wide scans still counted 21,899 unique IP addresses fingerprinted as vulnerable:
- 🇺🇸 ~6,200 in the United States
- 🇩🇪 ~5,100 in Germany
- Thousands more across the UK, Russia, Canada, Austria, France, and beyond
Germany's BSI reports ~85% of on-prem Exchange servers there remain unpatched. NCSC-NL has confirmed working exploit code is already public.
The detail teams keep missing: being on the right cumulative update isn't the same as being patched. A server can run Exchange 2019 CU15 and still be exploitable if the specific August 2026 security update wasn't applied on top. Build-number verification — not CU version — is the only reliable check:
Get-ExchangeServer | ft Name, Edition, AdminDisplayVersion
Full breakdown with detection commands and a remediation checklist:
👉 https://www.xpert4cyber.com/2026/09/cve-2026-62911-exchange-servers-exposed.html
Top comments (0)