Search: “Exchange Server 2016”

50 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 108 Ransomware 77 Malware 66 Exploit / PoC 50 Data breach 19 Threat actor 16 Advisory 12 Phishing & fraud 11 Policy & legal 10 Industry 3 AI tools & infra 2 Research 1 Tools 1

SeverityAll critical 184 high 126 medium 48 low 15 info 3

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net SecuritySep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-62911 CVE-2026-42897

Expert released PoC code for Microsoft Exchange CVE-2021

Security AffairsNov 23, 17:14 UTC · Nov 23, 2021Exploit / PoC in the wildCVE-2021-42321

URGENT — 4 Actively Exploited 0

The Hacker NewsMar 3, 07:56 UTC · Mar 3, 2021Exploit / PoC in the wildCVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs

17,000+ Microsoft Exchange servers in Germany are vulnerable to attack, BSI warns

Help Net SecurityMar 26, 00:00 UTC · Mar 26, 2024Exploit / PoC in the wildCVE-2024-21410 CVE-2024-26198

PoC exploit code for ProxyNotShell Microsoft Exchange bugs released online

Security AffairsNov 20, 19:41 UTC · Nov 20, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

On-Prem Microsoft Exchange Server CVE-2026

The Hacker NewsJun 10, 16:19 UTC · Jun 10, 2026Exploit / PoC in the wildCVE-2026-428971

Microsoft patches actively exploited Exchange, Excel zero-days (CVE-2021-42321, CVE-2021-42292)

Help Net SecurityNov 9, 00:00 UTC · Nov 9, 2021Exploit / PoC in the wildCVE-2021-42321 CVE-2021-42292 CVE-2021-38666+2 CVEs

Exchange Servers targeted via zero-day exploits, have yours been hit?

Help Net SecurityMar 15, 12:57 UTC · Mar 15, 2021Exploit / PoC in the wildCVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs

Microsoft Exchange 0day and exploit could allow anyone to be an admin

Security AffairsJan 25, 12:28 UTC · Jan 25, 2019Exploit / PoC

Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

Krebs on SecurityMar 2, 22:16 UTC · Mar 2, 2021Exploit / PoC in the wildCVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs

Microsoft updated MSERT to detect web shells used in attacks against Microsoft Exchange installs

Security AffairsMar 8, 13:11 UTC · Mar 8, 2021Exploit / PoC in the wildCVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs

Microsoft: Two New 0-Day Flaws in Exchange Server

Krebs on SecuritySep 30, 17:03 UTC · Sep 30, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-410821

Microsoft confirms two Exchange Server zero days are being used in cyberattacks

The RecordJan 10, 00:00 UTC · Jan 10, 2023Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

Microsoft Confirms 2 New Exchange Zero

The Hacker NewsOct 1, 05:48 UTC · Oct 1, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

Microsoft confirms Exchange zero

Security AffairsSep 30, 10:18 UTC · Sep 30, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

Microsoft updates guidance for ‘ProxyNotShell’ bugs after researchers get around mitigations

The RecordJan 10, 00:00 UTC · Jan 10, 2023Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

Microsoft Confirms Two Exchange Zero

Infosecurity MagazineSep 30, 15:30 UTC · Sep 30, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-41082

Microsoft Exchange admins advised to expand antivirus scanning

Help Net SecurityFeb 27, 00:00 UTC · Feb 27, 2023Exploit / PoC

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Cisco TalosMay 7, 19:50 UTC · May 7, 2021Exploit / PoC CVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs1

Bypassing Two-Factor Authentication on Outlook Web Access

Security AffairsOct 10, 12:34 UTC · Oct 10, 2017Exploit / PoC1

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.

Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).

SecurityWeekSep 8, 19:20 UTC · 7d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-55007+5 CVEs