Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.
- Shadowserver daily scans show ~22,000 unpatched Exchange servers worldwide.
- NCSC-NL reports a working exploit is circulating; Microsoft has not yet confirmed it.
- Germany's BSI says 85% of on-premises Exchange servers remain vulnerable.
- Exchange 2016/2019 fixes only via Extended Security Updates program through October 2026.
- Microsoft fixed another actively exploited Exchange flaw, CVE-2026-42897, in June 2026.
- Products
- Microsoft Exchange Server
- Countries
- United StatesGermanyNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear | 6.1 | 71% | KEV | KEV |
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC |
From the original article
1 min read at helpnetsecurity.com
Nearly 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, a critical authentication bypass vulnerability, according to daily scans from the Shadowserver Foundation. The United States and Germany top the list with 6,200 and 5,100 unpatched servers.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.