Nearly 22,000 Microsoft Exchange Servers Vulnerable to Critical Mailbox Hijacking Flaw Worldwide

Cybersecurity monitoring organization Shadowserver and international cyber authorities have reported that almost 22,000 internet-exposed Microsoft Exchange servers globally remain unpatched against a critical authentication bypass security vulnerability. Tracked as CVE-2026-62911, the vulnerability affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) platforms. The vulnerability allows authenticated attackers with basic privileges to elevate their permissions across networks via capture-replay techniques. If successfully exploited, malicious actors gain full access to all user mailboxes hosted on the targeted Exchange server, enabling them to read confidential corporate emails, send unauthorized messages, and exfiltrate sensitive attachments. The National Cyber Security Centre of the Netherlands (NCSC-NL) and Germany's Federal Office for Information Security (BSI) issued warnings confirming that proof-of-concept exploit code is actively circulating on the internet. According to telemetry data, the majority of unpatched exposed servers are located in the United States and Germany. Security experts emphasize that organizations operating on-premises Exchange servers must apply Microsoft's security updates immediately or isolate affected servers behind internal networks to prevent widespread email compromise and data theft.