www.it-connect.fr
Exchange Server: Nearly 22,000 Exposed Servers Vulnerable to CVE-2026-62911
Is your Exchange mail server exposed to the Internet? You should make sure it is properly protected against CVE-2026-62911, a critical security flaw discovered during the Pwn2Own Berlin contest. Nearly 22,000 Exchange servers may still be vulnerable. Here’s what you need to know about this flaw and how to protect yourself.
On August 11, 2026, as part of its August 2026 Patch Tuesday, Microsoft patched several security flaws in Exchange Server, including CVE-2026-62911. Considered critical, this vulnerability allows an attacker to remotely elevate privileges. "The attacker would be able to take control of the mailboxes of all Exchange users; they could therefore send emails, read emails, and download attachments.", Microsoft states.
It was discovered during Pwn2Own Berlin 2026 by Orange Tsai from the DEVCORE team. Thanks to this discovery, which allowed him to take full control of the system, he received a handsome reward: $200,000.
It should be noted that this vulnerability is not known to be exploited at this time (no report proves otherwise). It affects the most widely deployed versions of Microsoft’s mail server, namely: Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE).
What prompted me to write this article is an update to a report maintained by the Shadowserver Foundation. In fact, it monitors Exchange mail servers exposed on the web and vulnerable to various attacks. It notably tracks flaws that have marked Exchange’s recent history: ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), CVE-2024-21410 related to Extended Protection, and CVE-2025-53786. Two recent entries have also been added: CVE-2026-42897, the already-exploited zero-day flaw whose mechanics I detailed in May last year, and CVE-2026-62911 discussed in this article.
The Shadowserver Foundation scans the web to estimate the number of vulnerable servers, based on the detected server version, not on an exploitation attempt. A server that is reported is therefore not necessarily vulnerable, especially if a workaround has been applied.
How many servers are vulnerable to CVE-2026-62911?
According to the latest statistics, there are nearly 22,000 potentially vulnerable Exchange servers. At the top of the list are the United States with 6,200 servers and Germany with 5,100 servers. France is also present in this ranking with 693 servers, as is Switzerland with 393 servers.
Most importantly, what you need to understand is that a PoC exploit is available on GitHub. It consists of a Python script along with technical details, all of which is available on GitHub. However, a quick look at that page makes it clear that it describes a chain of several security flaws, including CVE-2026-62911;
How do you protect yourself?
As of today, the vulnerability is not listed in CISA’s KEV catalog. But don’t wait until it is to patch. Fixes have been available since August 11, 2026. Here is the version you need to install to stay protected:
- Exchange Server 2016 CU23 : build 15.1.2507.72
- Exchange Server 2019 CU14 : build 15.2.1544.44
- Exchange Server 2019 CU15 : build 15.2.1748.49 (KB5121574)
- Exchange Server Subscription Edition RTM : build 15.2.2562.46 (KB5121573)
One point of caution for late adopters: Exchange Server 2016 and 2019 have no longer been supported since October 14, 2025. On these versions, the August fix is delivered through the Extended Security Update program.
