Skip to content
Critical CVE-2026-62911 Exposes 22,000 Exchange Servers to Remote Code Execution

Critical CVE-2026-62911 Exposes 22,000 Exchange Servers to Remote Code Execution

First seen 1 Sep 2026, 06:59 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 2, 2026 at 06:18 UTC
  • •CVE-2026-62911 allows pre-authentication remote code execution on Exchange Servers.
  • •Approximately 22,000 Exchange servers remain exposed, with many unpatched as of September 1, 2026.
  • •Microsoft released patches on August 2026 Patch Tuesday, but exploitation has not yet been confirmed.

CVE-2026-62911 is a critical authentication bypass vulnerability affecting Microsoft Exchange Server versions 2016, 2019, and Subscription Edition. Disclosed after its demonstration at Pwn2Own Berlin 2026, the flaw allows attackers to exploit NTLM relay attacks via the MRSProxy endpoint, potentially gaining SYSTEM-level control. As of September 1, 2026, nearly 22,000 internet-facing Exchange servers remain vulnerable, with 21,899 unique IP addresses identified by the Shadowserver Foundation. Microsoft released patches on August 2026 Patch Tuesday, but many organizations have yet to apply these updates. The vulnerability has a CVSS score of 8.0 from Microsoft and 8.1 from the Zero Day Initiative, indicating a high severity. The Netherlands National Cyber Security Centre confirmed the availability of exploit code, which is characterized as low-effort and easy to weaponize. Organizations running unpatched versions are urged to apply the updates immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 46d ago How this analysis works

Timeline

2026-05-14
CVE-2026-42897 published
A vulnerability in Microsoft Exchange Server was disclosed, later added to CISA's KEV list.
Zero Day Initiative
2026-08-11
CVE-2026-62911 published
Microsoft disclosed a critical authentication bypass vulnerability affecting Exchange Server.
Zero Day Initiative
2026-08-22
First public PoC released
A proof-of-concept exploit code for CVE-2026-62911 was made publicly available on GitHub.
Gbhackers
2026-08-31
Pwn2Own demonstration
Orange Tsai demonstrated the exploit chain at Pwn2Own Berlin 2026, earning a $200,000 prize.
Tech.Yahoo
2026-09-01
21,000 Exchange servers identified as vulnerable
Shadowserver reported 21,899 unique IP addresses of unpatched Exchange servers exposed online.
Cybersecuritynews
2026-09-02
Microsoft patches CVE-2026-62911
Microsoft released updates to address the vulnerabilities during the August 2026 Patch Tuesday.
BleepingComputer

More articles in this cluster (16)

Following this threat?

Track CVE-2026-62911 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4