Nearly 22,000 Exchange Servers Remain Unpatched for Critical CVE-2026-62911
Summary
Daily scans found nearly 22,000 Exchange servers unpatched for CVE-2026-62911, an authentication-bypass flaw. Microsoft issued a fix on August 11, 2026; NCSC-NL says a working exploit is circulating, a claim Microsoft has not confirmed.
Key points
- Shadowserver Foundation daily scans found nearly 22,000 Microsoft Exchange servers still vulnerable to CVE-2026-62911.
- The critical flaw is described as an authentication bypass by capture-replay that can let an authorized attacker elevate privileges over a network.
- The United States and Germany had the highest reported counts of unpatched servers: 6,200 and 5,100, respectively.
- Microsoft released a fix on August 11, 2026. NCSC-NL says a working exploit is circulating online, but Microsoft has not confirmed this in its advisory.
- Exchange Server 2016 and 2019 receive security updates only through the Extended Security Updates program; NCSC-NL advises limiting these servers to internal access and replacing them if possible.
- Germany’s BSI said around 85 percent of on-premises Exchange servers in the country remained vulnerable.
Article Details
- Vulnerability Types
- Authentication bypass by capture-replay
- Privilege elevation
- Severity
- Critical; CVSS 8.0
- Affected Versions
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
- Exploitation Status
- reported
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- For Exchange Server 2016 and 2019, NCSC-NL advises restricting server access to internal networks and replacing the server if possible.
CVE
CVE-2026-42897In June 2026, Microsoft fixed CVE-2026-42897, an actively exploited Microsoft Exchange Server vulnerability.CVE-2026-62911Nearly 22,000 Microsoft Exchange servers are still unpatched against CVE-2026-62911, a critical authentication bypass flaw that can let an authorized attacker elevate privileges over the network.
People
Vendors
MicrosoftNearly 22,000 Microsoft Exchange servers are still unpatched against CVE-2026-62911, a critical authentication bypass flaw that can let an authorized attacker elevate privileges over the network.Trend MicroMicrosoft released the fix on August 11, 2026, and credits Orange Tsai of the DEVCORE Research Team, working with Trend Micro’s Zero Day Initiative, for the discovery.
Products
Countries
GermanyThe United States and Germany have the highest numbers of vulnerable servers, while NCSC-NL and BSI have urged immediate patching as a working exploit is reportedly circulating online.United StatesThe United States and Germany have the highest numbers of vulnerable servers, while NCSC-NL and BSI have urged immediate patching as a working exploit is reportedly circulating online.