21,899 Exchange Servers Still Open to Mailbox Hijack

The patch is not new, and it has been sitting in the August Patch Tuesday bundle for a month. None of that moved 21,899 servers. What did change in late August is that proof of concept code for the bug went up on GitHub, which converts a scan statistic into a target list.

What matters past the headline number is the payoff. Most Exchange bugs get sold on remote code execution: a shell, a foothold, then whatever the intruder decides next. This one is described in mailbox terms from the start. Read everything, send as anyone, download every attachment. The break in and the objective are the same step.

Key Takeaways

• The Shadowserver Foundation counted 21,899 unique IP addresses still vulnerable to CVE-2026-62911 on 31 August 2026, roughly 6,200 of them in the United States and 5,100 in Germany.
• CVE-2026-62911 is an authentication bypass by capture replay affecting Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition, patched in the August 2026 Patch Tuesday.
• Orange Tsai of the DEVCORE Research Team reported the flaw after chaining it at Pwn2Own Berlin 2026; public exploit code appeared in late August 2026.
• A successful attack yields control of every mailbox hosted on the compromised server, including sending mail as any user on it.
• Germany's CERT-Bund estimates roughly 85 percent of on premises Exchange servers in the country remain vulnerable.

What Is CVE-2026-62911?

CVE-2026-62911 is an authentication bypass by capture replay in Microsoft Exchange Server that lets an attacker reuse captured authentication material to act as a higher privileged account. Microsoft's Security Update Guide entry puts it in one line: "Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network."

The mechanism sits in MRSProxy, the Mailbox Replication Proxy endpoint Exchange exposes for mailbox moves. That endpoint accepts Negotiate authentication but does not verify channel bindings, which is exactly the check Extended Protection for Authentication exists to enforce. Without it, authentication aimed at one place can be relayed to another. Relay the Exchange machine account to MRSProxy and the service treats you as the server itself. CWE-294 has described this class for years. The novelty is the endpoint, not the technique.

Two framings are circulating and both are defensible. Microsoft rates it elevation of privilege at CVSS 8.0 and says the attacker must already be authorized; the public research chains it with two other bugs into unauthenticated code execution as SYSTEM, which is how it earned $200,000 at Pwn2Own Berlin 2026. Patch on the second reading.

What Does an Attacker Actually Get?

Full read and send access to every mailbox on the server. Not one executive's inbox, not one compromised session, but the whole store. As BleepingComputer reported, an attacker "would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments."

That capability is the same primitive underneath business email compromise. An invoice redirect works because the fraudulent message comes from the real address, quotes the real thread and arrives from the real server, so SPF, DKIM and DMARC all pass. Criminals normally have to phish or relay their way into a single account to get that. This bug hands it over for everyone on the server at once, without touching a password or triggering a second factor prompt.

How Many Mailboxes Is 21,899 Servers?

Nobody knows exactly, because Shadowserver counts IP addresses, not accounts. The gap between those two numbers is the whole story, so it is worth doing the arithmetic out loud. On premises Exchange deployments routinely carry hundreds to thousands of mailboxes per server. Take a deliberately conservative 100 mailboxes each, roughly a single small business, and 21,899 servers works out to about 2.2 million exposed mailboxes. At 500 each, a plausible figure for the mid sized organisations that keep mail on premises, it is around 11 million, near the population of Portugal.

This is an estimate, not a measurement, and it is offered as one. The point is that server counts systematically understate email exposure: five figures of infrastructure is seven or eight figures of inboxes, and inboxes are what attackers monetise. The geography carries the same distortion: the United States shows more raw instances at 6,200, but Germany's 5,100 comes from a far smaller install base, which is why heise reports CERT-Bund putting German exposure at 85 percent of the on premises fleet.

Why Are So Many Servers Still Unpatched?

Because a large share of the exposed fleet is running software that was never supposed to still be running. Exchange Server 2016 and Exchange Server 2019 reached end of support on 14 October 2025, and the paid Extended Security Update bridge that followed closed in April 2026. Organisations that missed both windows are now looking at a migration project, not a patch window, every time an advisory lands.

The German figures show how thin that bridge was. heise reported CERT-Bund finding single digit numbers of Exchange 2016 and 2019 servers in the country running Extended Security Update builds at all. Not a low percentage. Nine servers.

There is also a visibility problem. An internet facing Exchange server is often the last piece of on premises infrastructure a company owns, inherited by whoever is left and patched when someone remembers. Shadowserver now reports on this CVE daily, so national CERTs get a fresh list of vulnerable hosts in their jurisdiction every morning, whether or not the owners are looking.

What This Means for Your Inbox

Most people reading this do not administer an Exchange server. Nearly all of them correspond with someone who sits behind one. Suppliers, law firms, accountants, municipal offices and hospitals are exactly the organisations that kept mail on premises, and their messages land in your inbox looking entirely legitimate, because they are. The message is real. The sender is not.

Mailbox level access also means historical access. Whoever holds a compromised server can read years of threads before writing a single word, learning payment terms, invoice formats, internal nicknames and who approves what. That is the difference between a generic phishing email and the kind of fraud that survives a phone call. We watched a version of it play out slowly when attackers sat inside a stock exchange executive's inbox for five months, and at industrial scale when the Payroll Pirates crew ran hijacked Microsoft 365 mailboxes in eight hour shifts.

The response on the receiving end does not depend on anyone else patching. Verify payment changes over a channel that is not email, using a number you already had, and treat urgency in a familiar thread as a reason to slow down. Authentication headers prove a message came from the right server; they cannot prove the right person sent it.

What Should Defenders Do Right Now?

Apply the August 2026 security update, then verify the configuration the bug depends on rather than assuming it:

• Enable and confirm Extended Protection across Exchange virtual directories. Microsoft's Extended Protection guidance covers the rollout and its known compatibility caveats.
• Run the Exchange Health Checker. The official script reports build numbers and Extended Protection state, faster and more reliably than reading version strings by hand.
• Cut internet exposure. CERT-Bund advises restricting web facing Exchange services to trusted source addresses or a VPN, which removes the attack surface even where patching is stalled.
• Harden against relay generally. Require SMB and LDAP signing, and prefer Kerberos with channel binding over NTLM wherever Exchange clients allow it.
• Hunt, do not just patch. Look for recently created ASPX files in IIS and Exchange web directories, unusual NTLM authentication between Exchange hosts, and new mailbox forwarding rules or delegate permissions.

One scheduling note for anyone whose patch policy keys off federal deadlines. CVE-2026-62911 is not on CISA's Known Exploited Vulnerabilities catalog yet, so there is no binding due date attached to it. KEV listing is a lagging indicator by design: it records confirmed exploitation after the fact. Public exploit code plus 21,899 reachable targets is the leading one.

The Pattern Behind the Number

This is the third Exchange flaw we have covered in 2026 whose whole value is mailbox access, and the trajectory is worth noting. In May, CVE-2026-42897 fired JavaScript in Outlook Web Access when a victim opened a message, and CISA added it to KEV within weeks. In July, CVE-2026-54998 let ordinary Exchange Online users reach administrative territory. Each required either a user action or an existing account. This one needs neither, and the blast radius went from one mailbox to all of them.

CISA has listed 20 Exchange Server vulnerabilities since November 2021, 14 of which have been tied to ransomware activity. That base rate is the argument for urgency before anybody confirms exploitation. The servers are enumerated daily, the code is published, and the target is the most valuable data most organisations hold in one place.

Sources: BleepingComputer: Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks; Microsoft Security Update Guide: CVE-2026-62911; The Shadowserver Foundation: Vulnerable Exchange Server Report; heise: 85 percent of on-prem servers in Germany vulnerable; Microsoft Learn: Exchange Server 2019 and 2016 end of support roadmap; Zero Day Initiative: Pwn2Own Berlin 2026; MITRE: CWE-294 Authentication Bypass by Capture-replay. Mailbox estimates are the author's arithmetic from published server counts, not measured figures.