CVE-2026-62911

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition

Description An authentication bypass by capture-replay allows an authorized attacker to elevate privileges over a network. The issue occurs when authentication material is accepted in a context where stronger channel binding should prevent credential replay or relay-style abuse. A successful exploit allows an attacker to impersonate users and take control of all Exchange mailboxes, enabling them to read emails, download attachments, and send messages as legitimate users. Approximately 21,899 internet-exposed servers were identified as vulnerable, with significant concentrations in the United States (6,200) and Germany (5,100), where roughly 85% of on-premises servers remained affected.

Recommendations Install the Microsoft security updates released in August 2026 for all affected versions. For Exchange Server 2016 and 2019, ensure enrollment in the Extended Security Updates (ESU) program to receive the necessary security patches. Restrict unnecessary internet exposure and limit access to administrative endpoints. Review Exchange and IIS authentication logs, monitor for abnormal mailbox access, and inspect for suspicious inbox forwarding rules or unexpected mailbox delegations.