Full Report
Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. [...]
Analysis Summary
# Vulnerability: Microsoft Exchange Server Authentication Bypass and Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-62911
- **CVSS Score:** High Severity (Specific numerical score not provided in text, but categorized as high-severity privilege escalation)
- **CWE:** Authentication Bypass by Capture-Replay
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:**
- Exchange Server 2016
- Exchange Server 2019
- Exchange Server Subscription Edition (SE)
- **Configurations:** Servers exposed to the internet are at highest risk; approximately 22,000 instances are currently identified as unpatched and reachable online.
## Vulnerability Description
CVE-2026-62911 is an authentication bypass vulnerability involving capture-replay. It allows an authorized attacker (one with basic, low-level privileges) to elevate their privileges over a network. Technically, this enables the attacker to impersonate other users and hijack all mailboxes on the affected Exchange server.
## Exploitation
- **Status:** PoC available (Public exploit code is available online per NCSC-NL; not yet confirmed as exploited in the wild).
- **Complexity:** Low
- **Attack Vector:** Network
- **Interaction:** Requires user interaction.
## Impact
- **Confidentiality:** High (Attackers can read all user emails and download attachments).
- **Integrity:** High (Attackers can send emails as any user).
- **Availability:** Not specifically detailed, though mailbox hijacking compromises service utility.
## Remediation
### Patches
- Microsoft released fixes during the **August 2026 Patch Tuesday**.
- **Exchange Server SE:** Apply the latest cumulative updates.
- **Exchange Server 2016/2019:** Updates are available only via the **Extended Security Updates (ESU)** program.
### Workarounds
- **Network Isolation:** Ensure vulnerable servers are only accessible internally and not exposed to the public internet.
- **Decommissioning:** Replace end-of-life versions (2016/2019) with supported versions, as ESU support is scheduled to end in October 2026.
## Detection
- **Indicators of Compromise:** Monitor for unusual privilege escalation events or unauthorized access to multiple mailboxes from a single low-level account.
- **Detection methods and tools:**
- Utilize Shadowserver fingerprints to identify exposed, unpatched versions.
- Audit Exchange logs for replay-style authentication attempts.
## References
- **Vendor Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911)
- **NCSC-NL Alert:** [https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-microsoft-exchange-server](https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-microsoft-exchange-server)
- **Shadowserver Statistics:** [https://dashboard.shadowserver.org/statistics/combined/time-series/?tag=cve-2026-62911+](https://dashboard.shadowserver.org/statistics/combined/time-series/?tag=cve-2026-62911+)
- **CISA KEV Catalog Reference:** [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)