22,000 Microsoft Exchange servers still open to mailbox takeover flaw

Key points

• Around 21,899 Microsoft Exchange servers remain unpatched and reachable from the internet, according to Shadowserver data cited on Tuesday.
• The bug, CVE-2026-62911, lets an attacker with a low-level account take over every mailbox on the server.
• Microsoft shipped the fix in its August 2026 Patch Tuesday update.
• The Dutch national cyber agency NCSC-NL says working exploit code is already online.
• The United States has the most exposed servers (about 6,200), followed by Germany (about 5,100).

Another Exchange story where the patch exists, the exploit's public, and roughly 22,000 servers are still sitting on the internet waiting.

The flaw is CVE-2026-62911, an authentication bypass in Microsoft Exchange Server. A hacker who holds any low-level account can trick the server into treating them as someone far more powerful, then rifle through everyone's email. Microsoft says the attacker can "take over the mailboxes of all Exchange users" and "send emails, read emails, download attachments."

Orange Tsai of DEVCORE found it. When we covered the August 2026 Patch Tuesday on 7 August, this fix was among the updates Microsoft shipped that day. That was over a month ago.

How bad is it in practice?

Bad, because the barrier is low. The attacker needs an existing account on the target, but that's exactly what phishing delivers every day. Once inside, the failure mode is total: every mailbox on the box is readable and writable by the attacker.

The Netherlands National Cyber Security Centre (NCSC-NL) said last week that exploit code is already circulating publicly, as first reported by BleepingComputer. Microsoft hasn't updated its advisory to flag active exploitation, but the gap between "exploit exists" and "Microsoft confirms it's being used" is usually where the ugly weekends happen.

Who is still exposed?

Shadowserver, a non-profit that scans the internet for exposed systems, counted 21,899 Exchange servers still vulnerable on Tuesday. The United States leads with roughly 6,200. Germany is next at about 5,100.

A chunk of those servers runs Exchange 2016 or 2019, both past end of support. Patches only reach them through Microsoft's paid Extended Security Update program, and even that lifeline ends in October 2026, as we reported on 22 July. NCSC-NL's advice is blunt: if you're running one of these versions, take it off the public internet and plan the replacement now.

Should ordinary users worry?

If your employer runs its own Exchange mail server, yes, a bit. An attacker who gets in can send email that looks exactly like it came from your finance team or your IT desk, because it actually did come from that mailbox. Treat urgent payment requests and password reset prompts with extra suspicion over the next few weeks, especially if they arrive by email alone.

Cloud-hosted mailboxes are not affected by this specific bug.

The wider pattern

CISA has added 20 Exchange vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021. Fourteen of those have shown up in ransomware, the malicious software that locks a company's files until a ransom is paid. Another Exchange bug, CVE-2026-42897, was already being abused in cross-site scripting attacks against Outlook Web Access users before CISA ordered federal agencies to patch it in May.

The post-mortem will say it again: the patch was available, the exploit was public, and the server was on the internet.

If your Exchange box is reachable from the open internet and you haven't applied the August 2026 update, you're the target audience for whoever's holding that exploit.