Unpatched Microsoft Exchange Servers Exposed to Critical Vulnerability

A critical vulnerability in Microsoft Exchange servers has been discovered, allowing attackers to gain unauthenticated access to every mailbox hosted on the server. The vulnerability, known as CVE-2026-62911, was publicly disclosed on GitHub and allows attackers to coerce an Exchange server into authenticating outbound, capturing machine-account NTLM handshakes, and relaying them to the unprotected HTTP.sys endpoint.

The flaw resides in Exchange's Mailbox Replication Proxy Service (MRSProxy) component, which is exposed through two distinct paths: one hosted on IIS and another directly on Windows' HTTP.sys networking stack. The latter path skips channel-binding validation entirely, making it an open relay target for attackers.

According to Shadowserver Foundation's daily scans, approximately 21,899 Exchange servers worldwide are still unpatched as of August 31, 2026. The United States accounts for the largest share, with around 6,200 vulnerable servers, followed closely by Germany at roughly 5,100.

Microsoft formally disclosed the vulnerability and shipped a patch on August 11, 2026, but researchers have already published working proof-of-concept exploit code that automates the full attack chain. This has raised concerns that attackers may soon start exploiting this vulnerability to gain unauthorized access to Exchange servers.