Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.
- Patch shipped in August 2026 Patch Tuesday; Exchange 2016/2019 ESU ends October 2026
- Exploitation grants takeover of all mailboxes on the targeted server
- NCSC-NL advises keeping Exchange unreachable from the open internet until patched
- Zscaler recommends Zero Trust access (ZPA) to eliminate inbound exposure on port 443
- CVEs
- CVE-2026-62911
- Organizations
- ShadowserverNCSC-NLCISA
- Countries
- United StatesGermanyNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC |
From the original article
6 min read at zscaler.com
Microsoft's August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8. 0 from Microsoft.
By Mark Brozek (Senior Director, Product Marketing) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.