ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

NCSC-NL

0 mentions in 7 days · 1 in 30 days · 2 total · first seen · last

Search everything

Timeline

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net Security · 14d agoExploit / PoC in the wildCVE-2026-62911CVE-2026-42897

macOS Screen Sharing Flaw Exploited to Deploy Monero Miners

Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.

CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.

Security Affairs · Aug 15, 2026Exploit / PoC in the wildCVE-2026-65400

Related CVEs

  • CVE-2026-654009.810%
    Authentication Bypass in Apple macOS Screen Sharing
    CVE-2026-65400 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in Apple macOS's Screen Sharing service, caused by an authentication state-management defect. An attacker who can reach a vulnerable Mac's Screen Sharing service over the network can authenticate without valid credentials, gaining full remote access with high impact to confidentiality, integrity, and availability. All three currently supported macOS branches are affected: Sequoia, Sonoma, and Tahoe, in versions prior to the fixed releases. The flaw is being actively exploited on the internet, with public reporting that attackers use the bypass to deploy Monero cryptominers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18. EPSS estimates a 9.9% probability of exploitation within 30 days (95th percentile).
    · Apple macOS (Screen Sharing service) supported macOS releases prior to the fixed builds listed below · Apple macOS Sequoia all versions prior to 15.7.9 KEVmass
  • CVE-2026-428976.171%
    Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear
    CVE-2026-42897 is an improper-neutralization flaw (CWE-79) in Microsoft Exchange Server that lets an unauthenticated remote attacker perform cross-site scripting and carry out spoofing. Per the CVSS vector (AV:N/PR:N/UI:R), exploitation requires a victim to interact with attacker-controlled content — reported attacks by the Russian actor Laundry Bear (TA488) trigger when a crafted email is opened in Exchange's webmail interface (Outlook Web Access). The attacker gains the ability to spoof the victim within their webmail session, and reported intrusions show mailbox access persisting even after organizations rotate credentials. Any organization running on-premises Microsoft Exchange Server or Exchange Server Subscription Edition is potentially exposed, particularly those publishing webmail to the internet; specific affected version ranges are not provided in the available data. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2026-05-15 and carries a very high EPSS score of 71.2%, though no public proof-of-concept is known.
    · Microsoft Exchange Server · Microsoft Exchange Server Subscription Edition KEVlarge
  • CVE-2026-629118.01%
    Capture-Replay Authentication Bypass in Microsoft Exchange Server
    Microsoft Exchange Server contains an authentication bypass flaw (CWE-294) in which captured authentication material can be replayed, allowing an authorized attacker to elevate privileges over a network. Per the CVSS vector, the attack is network-based with low complexity but requires the attacker to already hold low privileges and some user interaction, and success yields high impact on confidentiality, integrity, and availability. Affected products include on-premises Exchange Server and Exchange Server Subscription Edition, though specific vulnerable version ranges are not specified in the available data. Public scans indicate nearly 22,000 Exchange servers remain exposed to the flaw following the August 2026 Patch Tuesday fixes. No in-the-wild exploitation, public proof-of-concept, or KEV listing is known; the bug was demonstrated at Pwn2Own (ZDI-26-534) and carries an EPSS estimate of 1.3% probability of exploitation within 30 days.
    · microsoft exchange server · microsoft exchange server subscription editionlarge

Appears with

malware Monero miner 1organization BSI 1organization Bynario 1organization Calif 1organization DEVCORE Research Team 1organization Microsoft 1organization NCSC-NL 1organization Shadowserver Foundation 1product macOS 1product Microsoft Exchange Server 1vendor Apple 1vendor BSI 1vendor DEVCORE 1vendor Microsoft 1vendor Shadowserver Foundation 1vendor Trend Micro 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.