Nearly 22,000 Microsoft Exchange Servers Remain Exposed: What Businesses Need to Do Now

A public proof of concept for CVE-2026-62911 has increased the risk facing organisations that still operate on-premises Microsoft Exchange. Here is what the vulnerability means, who is affected and what IT teams should do next.

Most cyber incidents do not begin with a dramatic warning. More often, a security update is released, the work is pushed into the next maintenance window, and the vulnerable system remains online.

That appears to be the problem now facing thousands of organisations running Microsoft Exchange Server.

On 1 September 2026, the Shadowserver Foundation reported that its daily internet scanning had identified at least 21,899 IP addresses associated with Microsoft Exchange systems that had not been patched against CVE-2026-62911. Approximately 6,200 were located in the United States and 5,100 in Germany.

The concern is not simply the number of exposed systems. Public proof-of-concept exploit code is now available, giving attackers a practical starting point for developing working attacks.

Microsoft released security updates for the vulnerability on 11 August 2026. Almost three weeks later, thousands of Exchange systems still appeared to be exposed.

For organisations operating an on-premises or hybrid Microsoft Exchange environment, this is a vulnerability that needs immediate attention.

What has happened?

CVE-2026-62911 is an authentication-related vulnerability affecting supported builds of on-premises Microsoft Exchange Server.

Microsoft classifies the vulnerability as High severity, with a CVSS 3.1 score of 8.0 out of 10. According to Microsoft's assessment, successful exploitation could allow an attacker to:

• Take control of Exchange mailboxes
• Read users' emails
• Send emails from compromised accounts
• Download email attachments
• Access sensitive information stored across affected mailboxes

The vulnerability was initially disclosed and patched as part of Microsoft's August 2026 security updates.

The situation became more urgent when the Dutch National Cyber Security Centre updated its advisory on 28 August to confirm that public proof-of-concept code was available. Shadowserver subsequently reported that nearly 22,000 internet-facing IP addresses still appeared vulnerable.

It is important to interpret that figure correctly. The count represents IP addresses detected by internet scanning, not 21,899 confirmed victims or necessarily 21,899 individual organisations. One organisation may operate several IP addresses, while some addresses may serve more than one system.

The figure nevertheless provides a useful indication of the scale of the remaining exposure.

Microsoft's CVSS assessment describes the vulnerability as:

• Remotely reachable over a network
• Low in attack complexity
• Requiring some existing privileges
• Requiring user interaction
• Capable of causing high confidentiality, integrity and availability impacts

Its published CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

For a technical team, the most significant parts of that assessment are the network-accessible attack path, low attack complexity and potential impact across confidentiality and integrity.

Exchange is also a particularly valuable target. Email systems contain financial information, contracts, personal data, customer conversations, password-reset messages and internal discussions. They also provide a trusted identity that can be used to contact employees, customers and suppliers.

A compromised mailbox is therefore not only a source of data. It can become a platform for further attacks.

Why public exploit code changes the risk

A proof of concept is code or technical documentation showing that a vulnerability can be exploited.

Its publication does not automatically mean that every exposed system is being attacked. It does, however, reduce the amount of work required for criminals to understand the vulnerability and develop their own tools.

The typical risk progression looks like this:

1. A vulnerability is discovered.
2. The vendor develops and releases a security update.
3. Technical details become more widely available.
4. Researchers or attackers publish proof-of-concept code.
5. Attackers adapt the code for scanning and exploitation.
6. Vulnerable internet-facing systems are targeted at scale.

Once working code becomes public, the advantage moves away from organisations waiting for a convenient maintenance window. Attackers can automate internet scanning, identify exposed systems and attempt exploitation much faster.

There is often a gap between initial exploitation and public confirmation. Attackers may also use access quietly, particularly when targeting email, credentials or commercially sensitive information.

Which Exchange versions are affected?

Microsoft lists the following on-premises products as affected:

• Microsoft Exchange Server 2016 CU23
• Microsoft Exchange Server 2019 CU14
• Microsoft Exchange Server 2019 CU15
• Microsoft Exchange Server Subscription Edition RTM

Organisations should install the appropriate August 2026 Security Update and confirm that the resulting build number matches Microsoft's published information.

Microsoft maintains an up-to-date list of Exchange Server build numbers and release dates.

Businesses using only Exchange Online, with no remaining on-premises Exchange Server, do not need to install these server updates.

Hybrid environments require more care. Even if most or all mailboxes have been moved to Microsoft 365, a locally operated Exchange server may still be present for recipient management, mail flow, connectors or other hybrid functions. That server must still be inventoried, secured and updated.

Why Exchange servers are attractive targets

Exchange sits at the centre of an organisation's communications and identity environment.

If an attacker gains mailbox access, they may be able to:

• Read confidential conversations and attachments
• Identify invoices, suppliers and payment processes
• Monitor discussions before impersonating a senior employee
• Send convincing phishing messages from a trusted address
• Intercept password resets or account-verification messages
• Create forwarding rules to maintain access to incoming email
• Study writing styles, reporting structures and commercial relationships
• Use legitimate email threads to conduct payment or invoice fraud
• Target connected Microsoft 365 services or business applications

This is why email compromise can remain damaging even if the initial technical intrusion appears limited.

An attacker does not always need to encrypt servers or take systems offline. Quiet access to executive, finance, HR or IT mailboxes may be more valuable than an immediately visible ransomware attack.

1. Confirm whether Exchange Server exists anywhere in the environment

Do not assume that moving mailboxes to Microsoft 365 removed every local Exchange dependency.

Check for:

• Production Exchange servers
• Hybrid management servers
• Legacy or decommissioning systems
• Disaster-recovery instances
• Test environments
• Servers left online for connectors or relay services
• Internet-facing hostnames and public IP addresses
• Systems managed by third parties

Asset discovery is essential because an unknown server cannot be patched or monitored.

2. Check the exact Exchange build

Exchange administrators should verify the installed cumulative update and security-update level.

Microsoft recommends using its Exchange Server Health Checker, which checks build information, security configuration and known areas of concern.

Administrators should not rely only on Get-ExchangeServer when confirming the installed security update. Microsoft notes that the version reported by ExSetup.exe provides a more reliable indication of the installed Exchange binaries.

For example:

Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }

Compare the result with Microsoft's published fixed build numbers.

3. Install the relevant security update

Affected servers should be patched as a priority.

Before installation:

• Confirm the current cumulative update
• Read Microsoft's installation notes
• Check prerequisites and known issues
• Ensure recent, usable backups are available
• Confirm monitoring and rollback arrangements
• Plan for the required Exchange and operating-system restarts

After installation:

• Restart the server if required
• Verify the resulting Exchange build number
• Run the Health Checker again
• Test internal and external mail flow
• Test Outlook, Outlook on the web and mobile access
• Check connectors, relays and hybrid functions
• Confirm that monitoring and backups are operating normally

A successful installer message alone should not be treated as proof that remediation is complete.

4. Reduce unnecessary internet exposure

If a vulnerable server cannot be patched immediately, its exposure should be restricted while remediation is completed.

Depending on the environment, temporary measures may include:

• Restricting administrative interfaces to a VPN or trusted network
• Limiting inbound access at the firewall
• Removing unnecessary published services
• Reviewing reverse-proxy and load-balancer rules
• Restricting access to management endpoints
• Increasing logging and monitoring around the server

These are risk-reduction measures, not substitutes for the security update.

5. Verify Extended Protection

Microsoft Exchange Extended Protection helps defend against certain authentication relay and man-in-the-middle techniques by strengthening the relationship between authentication and the protected connection.

Extended Protection is enabled by default in Exchange Server 2019 CU14 and later. Older supported configurations may require it to be enabled using Microsoft's supported tooling.

Organisations should review Microsoft's Exchange Extended Protection guidance before making changes.

This requires careful planning where an environment uses:

• SSL offloading
• Load balancers
• Reverse proxies
• Hybrid agents
• Non-standard authentication configurations
• Applications integrated with Exchange

Extended Protection is an important security layer, but it should not be treated as a replacement for patching CVE-2026-62911.

6. Investigate for signs of suspicious activity

Installing an update closes the vulnerability. It does not remove access that an attacker may already have established.

Security and Exchange teams should review activity from before the update was installed, paying particular attention to:

• Unusual mailbox logins
• Authentication from unfamiliar IP addresses or locations
• Unexpected NTLM authentication events
• Suspicious Windows logon events, including events 4624 and 4776
• New inbox or forwarding rules
• Messages being redirected to external addresses
• Unexpected delegates, Send As or Full Access permissions
• Large or unusual mailbox downloads
• Mailbox exports that cannot be explained
• Changes to Exchange administrator roles
• New transport rules, send connectors or receive connectors
• Unexpected OAuth applications or certificates
• Suspicious PowerShell activity
• Web shells or unfamiliar files in Exchange web directories
• Unexpected child processes started by Exchange or IIS
• Unusual outbound connections from the Exchange server

No single event proves that a system has been compromised. The value comes from correlating Exchange, IIS, Windows, identity, endpoint and network telemetry.

If suspicious activity is identified, preserve relevant evidence before rebuilding or making broad changes. The organisation may need to contain the server, revoke active sessions, reset exposed credentials and investigate connected systems.

7. Review privileged and high-value mailboxes first

Not every mailbox carries the same risk.

Prioritise investigation of:

• Global and Exchange administrators

• Directors and senior leadership

• Finance and accounts-payable employees

• HR and payroll teams

• IT support staff

• Legal and compliance teams

• Shared mailboxes used for payments or customer requests

• Accounts with broad delegation permissions

These accounts are more likely to contain sensitive data or provide a convincing identity for follow-on attacks.

8. Plan the move away from legacy Exchange versions

Exchange Server 2016 and Exchange Server 2019 are now legacy platforms. Organisations still operating them should treat this incident as a reason to review their longer-term Exchange strategy.

Microsoft offers limited Extended Security Updates for eligible systems through the end of October 2026. That provides a short period for transition, not a permanent extension of the platform's life.

The sustainable options are generally:

• Migrate fully to Exchange Online

• Move to Exchange Server Subscription Edition

• Retain only the minimum supported hybrid components that are genuinely required

• Remove abandoned or unnecessary Exchange servers from the environment

A migration plan should include identity, mail flow, third-party integrations, retention, compliance, archiving and recovery requirements.

Do MFA and backups solve the problem?

Multi-factor authentication and reliable backups remain essential, but neither replaces the need to patch.

MFA helps reduce the risk of an attacker signing in with a stolen password. It does not automatically prevent every server-side authentication or replay weakness.

Backups help an organisation recover data and services. They do not stop an attacker from reading emails, downloading attachments or impersonating employees before the incident is detected.

These controls address different parts of the risk:

• Patching removes the known vulnerability.
• Extended Protection strengthens relevant authentication paths.
• MFA reduces account takeover risk.
• Monitoring helps identify suspicious behaviour.
• Backups support recovery.
• Incident response planning helps the organisation act quickly when something goes wrong.

Good security comes from these controls working together.

Why this matters for UK businesses

The wider issue is not limited to Microsoft Exchange. It is the continuing gap between security updates being available and organisations applying them consistently.

The UK Government's Cyber Security Breaches Survey 2025/26 found that:

• 43% of UK businesses identified a cyber breach or attack during the previous 12 months
• The figure increased to 65% for medium-sized businesses
• It reached 69% for large businesses
• Only 34% of businesses had a policy to apply software security updates within 14 days
• Only 25% had a formal incident-response plan

Those figures help explain why vulnerabilities can remain exposed after a fix becomes available.

The difficulty is not always a lack of awareness. Patching an Exchange server may require downtime, testing, application checks, senior approval and coordination with external IT providers. Older environments can also contain undocumented dependencies that make teams hesitant to change them.

Those are genuine operational challenges. They do not reduce the security risk.

A practical vulnerability-management process should therefore define:

• Who owns each system
• Who monitors vendor advisories
• How vulnerabilities are prioritised
• How quickly critical and high-risk updates must be assessed
• Who approves emergency maintenance
• How updates are tested
• How installation is verified
• What happens when patching cannot be completed within the target window

Without clear ownership, important updates can sit between security, infrastructure, application and management teams while the exposure remains.

The key takeaway

The headline does not mean that nearly 22,000 organisations have already been breached.

It means that almost 22,000 internet-facing IP addresses still appeared vulnerable after Microsoft had released a security update and after public proof-of-concept code became available.

That combination creates a shrinking window for safe delay.

Organisations operating on-premises or hybrid Microsoft Exchange should identify every server, verify the installed build, apply the relevant August 2026 update, check Extended Protection and investigate for suspicious activity.

If Exchange Server 2016 or 2019 remains in use, the organisation should also have a clear and funded migration plan.

Sources and further reading

• Microsoft Security Response Center: CVE-2026-62911
• Microsoft Exchange build numbers and release dates
• Microsoft Exchange Server Health Checker
• Microsoft guidance on Exchange Extended Protection
• Dutch NCSC advisory NCSC-2026-0289
• Shadowserver vulnerable Exchange Server reporting
• Shadowserver report of 21,899 vulnerable IP addresses
• UK Cyber Security Breaches Survey 2025/26
• CISA Microsoft Exchange Server security best practices