Search: “Exchange Server 2016”

126 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 108 Ransomware 77 Malware 66 Exploit / PoC 50 Data breach 19 Threat actor 16 Advisory 12 Phishing & fraud 11 Policy & legal 10 Industry 3 AI tools & infra 2 Research 1 Tools 1

SeverityAll critical 184 high 126 medium 48 low 15 info 3

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net SecuritySep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-62911 CVE-2026-428971

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber SecuritySep 8, 19:03 UTC · 8d agoAdvisory in the wildCVE-2026-81963 CVE-2026-858801

On-Prem Microsoft Exchange Server CVE-2026

The Hacker NewsJun 10, 16:19 UTC · Jun 10, 2026Exploit / PoC in the wildCVE-2026-428971

Over 61% of Exchange servers vulnerable to CVE-2020-0688 attacks

Security AffairsSep 30, 15:56 UTC · Sep 30, 2020Vulnerability CVE-2020-0688

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabzSep 3, 20:19 UTC · 13d agoVulnerability CVE-2026-629112

Head Mare and Twelve: Joint attacks on Russian entities

Kaspersky SecurelistMar 13, 10:07 UTC · Mar 13, 2025Ransomware CVE-2023-38831 CVE-2021-26855

Patch Tuesday - September 2026

Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.

Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.

Rapid7 BlogSep 8, 21:44 UTC · 7d agoVulnerability in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-85046+10 CVEs

Play ransomware attacks use a new exploit to bypass ProxyNotShell mitigations on Exchange servers

Security AffairsDec 21, 23:26 UTC · Dec 21, 2022Ransomware CVE-2022-41040 CVE-2022-41082 CVE-2022-41080

Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole

Cisco TalosOct 6, 18:00 UTC · Oct 6, 2022Ransomware CVE-2022-41040 CVE-2022-41082

Several Malware Families Targeting IIS Web Servers With Malicious Modules

The Hacker NewsAug 6, 05:11 UTC · Aug 6, 2021Malware

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.

Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).

SecurityWeekSep 8, 19:20 UTC · 8d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2026-55007+5 CVEs1

Vulnerability Spotlight: Two vulnerabilities in RDP for Windows 7, XP

Cisco TalosDec 10, 19:46 UTC · Dec 10, 2019Vulnerability in the wildCVE-2019-1453 CVE-2019-1489

Romanian Police Arrest 5 People for Spreading CTB Locker and Cerber Ransomware

The Hacker NewsDec 20, 18:01 UTC · Dec 20, 2017Ransomware

Prometei Botnet Exploiting Unpatched Microsoft Exchange Servers

The Hacker NewsApr 23, 15:00 UTC · Apr 23, 2021Vulnerability CVE-2021-27065 CVE-2021-26858

Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities

Help Net SecurityApr 22, 00:00 UTC · Apr 22, 2021Vulnerability CVE-2021-27065 CVE-2021-26858

Cryptomixer crypto laundering service taken down by law enforcement

Help Net SecurityDec 1, 00:00 UTC · Dec 1, 2025Ransomware

U.K. seeks to build “cyber power” via new national cybersecurity strategy

The RecordJan 18, 00:00 UTC · Jan 18, 2023Ransomware

Europol Takes Down Illegal Cryptocurrency Mixing Service

Infosecurity MagazineDec 1, 11:10 UTC · Dec 1, 2025Ransomware

Threat Source Newsletter (Dec. 9, 2021)

Cisco TalosDec 9, 19:00 UTC · Dec 9, 2021Vulnerability CVE-2021-44515

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.