Zero Day Initiative

www.zerodayinitiative.com • September 2, 2026

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of authentication requests. The issue results from using an alternative, weak authentication path. An attacker can leverage this vulnerability to bypass authentication on the system.

Microsoft has issued an update to correct this vulnerability. More details can be found at:

2026-05-21 - Vulnerability reported to vendor

2026-08-11 - Coordinated public release of advisory

2026-08-11 - Advisory Updated

Orange Tsai (@orange_8361) from DEVCORE Research Team

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-62911 Exposes 22,000 Exchange Servers to Remote Code Execution CVE-2026-62911 is a critical authentication bypass vulnerability affecting Microsoft Exchange Server versions 2016, 2019, and Subscription Edition. Disclosed after its demonstration at Pwn2Own Berlin 2026, the flaw allows attackers to exploit NTLM relay attacks via the MRSProxy endpoint, potentially gaining SYSTEM-level control. As of September 1, 2026, nearly 22,000 internet-facing Exchange servers remain vulnerable, with 21,899 unique IP addresses identified by the Shadowserver Foundation. Microsoft released patches on August 2026 Patch Tuesday, but many organizations have yet to apply these updates. The vulnerability has a CVSS score of 8.0 from Microsoft and 8.1 from the Zero Day Initiative, indicating a high severity. The Netherlands National Cyber Security Centre confirmed the availability of exploit code, which is characterized as low-effort and easy to weaponize. Organizations running unpatched versions are urged to apply the updates immediately to mitigate risks. 9 sources 72

Extracted Entities

Zero Day Initiative

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)