Microsoft Exchange CVE-2026-62911: 22,000 Servers Unpatched as Public Exploit Circulates

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Infrastructure and cloud security for US and EU enterprise teams

The short answer

What happened and why it matters

Microsoft disclosed CVE-2026-62911 on August 11, 2026, the same day security researchers who discovered it presented at Pwn2Own Berlin 2026 through Trend Micro's Zero Day Initiative. The fix arrived two days later with Patch Tuesday, but as of August 31 — three full weeks after the fix shipped — nearly 22,000 servers remain exposed. That figure comes from researchers scanning the open internet for Exchange instances that have not yet applied the cumulative update.

What changed the calculus on September 2 was the public confirmation from the Netherlands NCSC-NL, one of Europe's most technically credible national security centres. Their advisory stated that "a working exploit for the vulnerability is now circulating online." This is not a theoretical risk model or researcher proof-of-concept — it is a government security authority saying functional attack code is available to adversaries. Combined with a large unpatched surface and the low attack complexity (the flaw requires only network access and a low-privilege existing account, with no user interaction needed), the conditions for mass exploitation are in place. For teams that have been treating this as a normal Patch Tuesday backlog item, that calculus should shift to emergency patching.

How does the capture-replay attack work?

The flaw lives in Exchange Server's MRSProxy endpoint, a component used for mailbox replication and migration between Exchange servers. Microsoft's architecture requires this endpoint to be reachable from the network for migration workflows to function — but in the affected versions, MRSProxy fails to enforce Extended Protection for Authentication (EPA), the mechanism that ties an NTLM authentication token to a specific TLS channel and prevents it from being reused on a different connection.

Without EPA, an attacker with existing low-privilege authenticated network access can intercept the NTLM authentication exchange between an Exchange server and a domain controller, then replay those captured credentials against Exchange to impersonate the machine account. From there, because Exchange servers hold high-privilege access to Active Directory and user mailboxes by design, the replayed credential gives the attacker control over every Exchange mailbox on the server — read, write, send, and delete access without knowing a single user's password.

This is an NTLM relay attack in a category that Microsoft has been closing progressively across its product portfolio, which is exactly why EPA exists. The practical severity here is not theoretical: a compromised Exchange machine account is an Active Directory principal with broad delegation rights, and from Exchange an attacker can pivot to other directory operations depending on how the on-premises environment is configured. This is the same class of lateral-movement path that organizations have been warned about through frameworks like Microsoft's Enterprise Access Model and CISA's Zero Trust guidance.

How exposed is the internet-facing Exchange population?

Researchers scanning the public internet as of August 31, 2026 counted 21,899 unique IP addresses hosting Exchange Server instances that have not applied the August 13 cumulative update. The geographic distribution is uneven: the United States accounts for approximately 6,200 of those servers, the single largest national cluster. Germany accounts for roughly 5,100, and is reported to have the highest relative exposure rate among major economies — an estimated 85% of all German on-premises Exchange deployments are currently running the vulnerable version.

These are servers reachable from the open internet, which is a subset of total Exchange deployments. Internal-only Exchange instances are harder to exploit remotely (an attacker needs to already be on the network to perform the capture-relay), but they remain at risk from insider threats or attackers who have already gained a foothold through a different vector. The public-facing figure of 22,000 is what determines the immediate, unauthenticated-network-level risk.

The size of the unpatched population three weeks after a fix shipped reflects a well-documented organizational pattern: large on-premises Exchange environments require careful patch testing, change-management approval cycles, and scheduled maintenance windows that slow patching relative to cloud-hosted mail. With a public exploit now confirmed, those organizational processes need to be accelerated or a compensating control put in place — restricting MRSProxy access to the internal network is a workable short-term step for environments that cannot patch immediately.

What it means for US & EU software teams

The immediate message is straightforward: patch now. But the deeper business question for any team still running Exchange 2016 or 2019 is the one this vulnerability forces into the open. Extended Security Update (ESU) coverage for Exchange 2016 and 2019 ends in October 2026. After that date, vulnerabilities in these versions will receive no security patches unless Microsoft makes an exceptional exception, which is not a planning assumption. An unpatched critical Exchange vulnerability after the ESU deadline is a permanent condition, not a temporary lag.

That gives organizations running these versions a defined and very near-term decision point: upgrade to Exchange Subscription Edition on-premises, or migrate to Exchange Online / Microsoft 365. For many enterprises, the cloud migration path is operationally simpler and eliminates the entire category of on-premises-server vulnerabilities like CVE-2026-62911. For teams in regulated industries, it can also simplify compliance: Microsoft 365's compliance posture carries SOC 2 Type II, ISO 27001, and HIPAA attestations that an on-premises deployment must be separately audited for.

From a compliance standpoint, European organizations should note that a successful exploitation of CVE-2026-62911 gives an attacker access to the full contents of corporate mailboxes — which almost certainly contain personal data of EU residents, triggering GDPR Article 33's 72-hour breach notification obligation to the relevant supervisory authority if the access is unauthorized. For FinTech firms under DORA, an Exchange-based breach that affects business communications infrastructure may also require reporting as an ICT incident. The compliance clock starts on discovery, not on confirmed exfiltration, so having a tested incident response procedure linked to your Exchange environment matters now.

The broader pattern here is also worth naming: NTLM relay vulnerabilities on Microsoft infrastructure are a durable attack class. Microsoft has shipped EPA enforcement progressively across products specifically to eliminate this family of attacks, but the on-premises Exchange installed base is slow to patch and large in aggregate. Any organization with Exchange on-premises should treat their Microsoft NTLM/Kerberos hygiene — enforced EPA, SMB signing, LDAP signing, Protected Users group, tiered admin architecture — as an ongoing investment rather than a check-box completed once.

What to do this week

1. Patch immediately. Apply the August 13, 2026 Patch Tuesday cumulative update to every Exchange 2016 CU23, 2019 CU14/CU15, and SE RTM server. This is the only complete fix.
2. If you cannot patch right now, restrict MRSProxy. Block external access to the MRSProxy endpoint at your network perimeter; move it to internal-only access. This does not fix the flaw but removes the primary remote-exploit surface.
3. Review authentication logs. Search Exchange and domain controller logs for anomalous NTLM relay patterns, unusual privilege escalations, or unexpected mailbox access events since August 11. If you find evidence of prior exploitation, escalate to incident response immediately and begin breach-notification assessment under GDPR (72h) and any applicable US state rules.
4. Enable Extended Protection for Authentication across Exchange. Even after patching, enabling EPA site-wide on Exchange makes the relay attack class structurally harder going forward. Microsoft's guidance on EPA for Exchange is in the August advisory.
5. Set a firm decision date on Exchange 2016/2019 retirement. October 2026 ESU end-of-life is not a rumour — it is a published Microsoft deadline. If you are still on these versions, you need a migration plan finalized in September and execution in October at the latest. Deferring means accepting permanently unpatched infrastructure.
6. Consider a security assessment on your Exchange environment. If your Exchange deployment has been internet-accessible since August 11 and you have not yet patched, a compromise assessment is warranted before you return the environment to full production trust.

Frequently asked questions

Sources

Help Net Security — Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
BleepingComputer — Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
Microsoft Security Response Center — CVE-2026-62911 Exchange Server Elevation of Privilege Vulnerability
SentinelOne Vulnerability Database — CVE-2026-62911