CVE-2026-62911
CVSS 8 HIGH: authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate… Microsoft patch: 5121576.
Patch available KB5121576
Vulnerabilities & Exploits · Web App Attack
BleepingComputer reports that nearly 22,000 internet-exposed Microsoft Exchange servers remain unpatched for two flaws, including CVE-2026-62911, an authentication bypass that can let an attacker hijack mailboxes, and CVE-2026-42897, a cross-site scripting bug. The scale matters because the affected servers are still reachable from the internet.
The bypass is the bigger problem: once an attacker gets past Exchange's login check on the server, the server can treat them as already authenticated and let them operate across the mailboxes it serves. That means the compromise can sit at the Exchange layer instead of looking like a single stolen account, which makes account-only monitoring easier to miss.
For organizations that put a shared Exchange server between users and their mail, the exposure is tenant-wide until the server is fixed. The second flaw adds to the patch burden, but the main risk here is the trust boundary itself: one exposed server can stand in for many mailbox identities at once.
2 sources · Sep 2
CVSS 8 HIGH: authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate… Microsoft patch: 5121576.
Patch available KB5121576
Help Net Security
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911) - Help Net Security
Nearly 22,000 Microsoft Exchange servers stay exposed to CVE-2026-62911, a high-severity flaw with public exploit code online.
originalBleepingComputer
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes.
originalPart of the PlainSec briefing for 2026-09-02
Every edition of this story: Exchange servers leave mailboxes open to hijack