Nearly 22,000 Microsoft Exchange Servers Vulnerable to Hijacking

Nearly 22,000 internet-exposed Microsoft Exchange servers remain unpatched against a high-severity vulnerability that could allow attackers to take over user mailboxes.

The flaw, CVE-2026-62911, affects Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition. Microsoft fixed the issue in its August 2026 Patch Tuesday updates.

Flaw can let attackers access all mailboxes

DEVCORE Research Team’s Orange Tsai reported the vulnerability, which is an authentication bypass caused by a capture-replay issue.

An attacker with basic access to a vulnerable server can exploit the flaw in a low-complexity attack that requires user interaction. Successful exploitation could allow them to elevate privileges over the network.

Security researchers warned that an attacker could take over every Exchange mailbox on the affected server. That access could allow them to send and read email, as well as download attachments.

Although Microsoft has not confirmed active exploitation, the Netherlands National Cyber Security Centre said public exploit code is already available.

Most exposed servers are in the US and Germany

Shadowserver identified 21,899 IP addresses with Microsoft Exchange Server fingerprints that were still exposed online and unpatched.

The United States accounted for around 6,200 of those systems, while Germany had approximately 5,100. The figures do not confirm how many servers remain actively vulnerable, but they show that a large number of potentially affected systems are accessible from the internet.

The Dutch NCSC urged administrators to install Microsoft’s updates immediately. It also advised organisations running Exchange Server 2016 or 2019 to restrict the servers to internal access and replace them where possible.

Older Exchange versions face an approaching deadline

Exchange Server 2016 and 2019 receive security updates only through Microsoft’s Extended Security Updates programme. Microsoft has said those updates will stop arriving in October 2026.

The company previously warned customers that both versions had reached end of support. CISA and the NSA later published joint hardening guidance to help organisations protect Exchange environments.

Exchange servers have been a frequent target for cybercriminals and state-backed groups. Since November 2021, CISA has added 20 Exchange Server vulnerabilities to its Known Exploited Vulnerabilities catalogue, including 14 linked to ransomware activity.

Microsoft also patched another actively exploited Exchange vulnerability, CVE-2026-42897, in June following cross-site scripting attacks against Outlook Web Access users.