CVE
CVE-2026-62911
- First Reported
- Aug 11, 2026
- Latest Reported
- Sep 6, 2026
CVE Enrichment
- CVSS
- 8.0 HIGH
- EPSS
- 0.69%
- EPSS Percentile
- 52.32%
- CISA KEV
- Not listed
Description
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 12-Aug-2026 00:18
- Last Modified
- 15-Oct-2026 05:10
- EPSS Date
- 2026-10-21
- CWE
- CWE-294
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:L /
UI:R /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:* - microsoft / exchange_server
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:* - microsoft / exchange_server_subscription_edition
Version / affected range: * · before (exclusive) 15.02.2562.046
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (5)
- Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911) Week in Review: Infostealer Account Takeovers, Active Exploits and Major Data Breaches
- Exploit code has been published for CVE-2026-62911, a high-severity Microsoft Exchange Server vulnerability patched in August, the Netherlands National Cyber Security Centre warns. Microsoft Cloud Patches, Dropbox Account Compromise, and Other Cybersecurity News
- #SharePoint September 2026 Patch Tuesday forecast: High patch volumes may continue
- Nearly 22,000 Microsoft Exchange servers are still unpatched against CVE-2026-62911, a critical authentication bypass flaw that can let an authorized attacker elevate privileges over the network. Nearly 22,000 Exchange Servers Remain Unpatched for Critical CVE-2026-62911
- server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin Childs notes. Microsoft Fixes 421 CVEs in August 2026 Patch Tuesday, Including Exploited Zero-Day
CVE (23)
Malware (1)
People (14)
Threat Actors (5)
MITRE ATT&CK (1)
Vendors (18)
Products (36)
Tools (2)
Industries (3)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.