Nearly 22,000 Exchange Servers Are Still Vulnerable Despite Microsoft’s August Patch

Nearly 22,000 Microsoft Exchange servers remain vulnerable to a high-severity authentication bypass flaw that could give attackers access to every user mailbox on affected systems.

Shadowserver identified 21,899 vulnerable Exchange server IP addresses exposed to the internet. Around 6,200 are located in the United States, while approximately 5,100 are in Germany.

Thousands of Exchange servers remain unpatched

The vulnerability, tracked as CVE-2026-62911, affects Microsoft Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition.

Microsoft addressed the vulnerability during the August 2026 Patch Tuesday, when the company released fixes for around 400 security flaws.

Attackers with basic privileges can exploit CVE-2026-62911 through a low-complexity attack that requires user interaction. Successful exploitation can give an attacker access to all Exchange user mailboxes on the affected server.

Despite the security update being available, nearly 22,000 internet-facing servers still appear vulnerable.

Public exploit code raises the risk

Microsoft has not confirmed that attackers are actively exploiting CVE-2026-62911 in the wild.

However, the Netherlands National Cyber Security Centre says public exploit code for the vulnerability already exists. The agency is urging organizations to install Microsoft’s security updates as soon as possible.

The availability of public exploit code increases the risk for organizations that continue exposing unpatched Exchange servers to the internet.

NCSC-NL also recommends restricting Exchange Server 2016 and Exchange Server 2019 systems to internal access where possible and planning a move away from the older versions.

That recommendation is becoming more important because Microsoft’s Extended Security Update program for Exchange Server 2016 and 2019 ends in October. Organizations still running these versions may want to use the remaining support window to accelerate their upgrade plans.

In other Exchange-related news, Outlook users recently experienced problems during an Exchange Online outage.

Via BleepingComputer