Over 21,000 Exchange Servers Still Exposed to CVE-2026-62911 Attacks

Over 21,000 Microsoft Exchange servers worldwide are still unpatched against CVE-2026-62911, a critical authentication bypass that is already being exploited. A September 1, 2026 report puts the number near 22,000. Attackers can use that hole to seize control of enterprise email infrastructure. If your shop still runs Exchange on its own hardware, this is your problem today, not a note for next quarter.

What an authentication bypass does to your mail

Forget the CVE label for a minute. Authentication bypass means the login check does not do its job. Someone who should be stopped at the door gets treated like they belong there. They do not need your password to start working the system.

For a normal company, Exchange is not a side project. It is invoices, customer threads, password resets, and the record of who promised what. Control of that box is control of the business conversation.

21,000 exposed servers is a lot of open doors

The count is not a rounding error. Over 21,000 servers, nearly 22,000, still running without the fix, still exposed, with exploitation already active. Every one of those is a mail system somebody depends on.

I have watched this same pattern for decades. The vendor ships a patch. The people who keep a town’s shops and clinics online are busy, short-staffed, and scared to reboot the one machine that cannot go down. So the door stays unlocked. Attackers know that. They count on it.

What this means if you run the Exchange box

You do not need a 40-page threat briefing. You need the hole closed.

Apply the fix for CVE-2026-62911 on every Microsoft Exchange server you have, including the forgotten one in the closet.
If you cannot patch this minute, pull public internet access to that server. Webmail and admin pages do not need to face the whole world.
Review accounts, mailbox rules, and connectors for anything you did not create.
Confirm backups actually restore. Email servers are a favorite target once the door is open.

What this means if you just work there

Most folks never touch the server and still eat the damage. Watch for password reset messages you did not ask for, sudden payment-change mail that looks like it came from the boss, and inbox rules you do not recognize. If your company hosts its own Exchange, it is fair to ask whether this patch is in. You are not being a pest. You are looking after your people.

The part the patch notes will not say

Microsoft can publish a fix. It cannot walk into 21,000 buildings and install it. Leaving this many mail servers exposed while attacks are active is a systems failure. Vendors will say customers should have updated. Regular shops needed software that does not turn one late weekend into a company-wide email takeover.

Freedom and control over your own data start with a mail system you actually run, not one that anyone on the internet can stroll into. Patch it. Then decide if you still want that box on the public internet at all.

Do these four things today

Find out if you still run on-premises Microsoft Exchange, not just cloud mail.
If you do, verify CVE-2026-62911 is patched on every server.
Shut off public access you do not truly need.
Treat any still-exposed, still-unpatched Exchange host as unsafe until you have checked it.

Primary Source: https://cybersecuritynews.com/exchange-servers-remain-exposed-2026-62911/