Nearly 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, a critical authentication bypass vulnerability, according to daily scans from the Shadowserver Foundation.
The United States and Germany top the list with 6,200 and 5,100 unpatched servers.
CVE-2026-62911 is a critical severity vulnerability, and Microsoft describes it as “authentication bypass by capture-replay in Microsoft Exchange Server,” which allows an authorized attacker to elevate privileges over a network.
Microsoft released the fix on August 11, 2026, and credits Orange Tsai of the DEVCORE Research Team, working with Trend Micro’s Zero Day Initiative, for the discovery.
Although Microsoft has not yet confirmed this in its advisory, the National Cyber Security Centre of the Netherlands (NCSC-NL) flagged last week that a working exploit for the vulnerability is now circulating online.
“Multiple serious vulnerabilities have been found in Microsoft Exchange Server. One of these vulnerabilities is CVE-2026-62911, with a CVSS score of 8.0,” NCSC-NL warned.
“Microsoft has made updates available to address the vulnerabilities. Install these updates as soon as possible,” NCSC-NL noted. “Exchange Server 2016 and 2019 only receive security updates via the Extended Security Updates Program (ESU). Are you using one of these versions? If so, ensure that the server is accessible only internally and replace it if possible.”
“Don’t know which version of Exchange Server your organization uses? Then contact your IT administrator or IT service provider,” NCSC-NL aded.
Germany’s Federal Office for Information Security (BSI) wrote on its Mastodon account on August 28, 2026, that around 85 percent of on-premises Exchange servers in the country remain vulnerable to CVE-2026-62911.
In June 2026, Microsoft fixed CVE-2026-42897, an actively exploited Microsoft Exchange Server vulnerability.
“Exchange Server 2016 and 2019 are out of support. Only customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026,” Microsoft said on its blog.