A working exploit for CVE-2026-62911, a critical Microsoft Exchange Server authentication bypass, was published on 1 September 2026. Nearly 22,000 servers worldwide are still unpatched. Here is what to do right now.