Exchange Server: Public Exploit Out, 22,000 Still Unpatched

A working exploit for a serious Microsoft Exchange Server vulnerability was made public on 1 September 2026 — and nearly 22,000 servers worldwide are still not patched. If your business runs an on-premises Exchange server, this needs your attention today.

What happened

The vulnerability is tracked as CVE-2026-62911 and rated CVSS 8.0. It is an authentication bypass by capture-replay — a technique where an attacker intercepts legitimate authentication data on the network and replays it to impersonate a privileged user, without needing to know any passwords.

Microsoft released a fix as part of its August 2026 Patch Tuesday update on 11 August. Patch Tuesday is Microsoft’s monthly security update cycle, released on the second Tuesday of every month. Despite the patch being available for nearly three weeks, internet-wide scanning carried out on 31 August found 21,899 unique Exchange servers still running the vulnerable version.

Then, on 1 September, security researchers published a proof-of-concept exploit. The exploit chains the authentication bypass with an NTLM relay attack and a file-write call to achieve full remote code execution — without needing any valid credentials — reportedly in under five minutes.

Exchange Online (part of Microsoft 365) is not affected. This applies only to businesses running Exchange Server 2016, 2019, or the Exchange Subscription Edition on their own on-premises infrastructure.

Why it matters to your business

An on-premises Exchange server sits at the centre of your organisation’s communication. A successful attack gives an intruder access to every mailbox on the system, the ability to read, modify or delete emails and calendar data, and — crucially — a foothold inside your network from which to move to other systems.

With a public, working exploit now available, automated scanning tools used by criminal groups will begin targeting unpatched servers systematically if they have not started already. An Exchange server exposed to the internet without the August patch is not just a risk: it is a target.

Organisations still running on-premises Exchange tend to be smaller businesses, professional services firms, or those with specific data-handling requirements. Many have limited internal IT resource — which is partly why so many have not yet applied the update. That is exactly the kind of gap well-resourced attackers look for.

What we have already done

For clients whose Exchange environments are managed by System Force IT, we applied the August Patch Tuesday updates during scheduled maintenance windows and have verified patch status. If you are a System Force IT client and want confirmation, contact us and we will check immediately.

Proactive, timely patch management is a core part of our IT support and maintenance service. We monitor vendor advisories and security bulletins and apply critical updates as they become available, so clients are not left exposed in the window between a patch release and its application.

What you should do now

If you manage your own Exchange servers, or work with a provider other than System Force IT, the patched build numbers you need are:

• Exchange Server 2016 CU23: build 15.1.2507.72 or later
• Exchange Server 2019 CU14: build 15.2.1544.44 or later
• Exchange Server 2019 CU15: build 15.2.1748.49 or later
• Exchange Subscription Edition RTM: build 15.2.2562.46 or later

You can check your current build number from the Exchange Admin Centre under Servers > Servers, or from the About screen within the Exchange Admin Centre itself.

While you are reviewing this, two broader questions are worth asking:

• Does your Exchange server need to be internet-facing? Restricting Exchange to internal access only — or using a properly configured reverse proxy — significantly reduces the attack surface. If it does not need to be directly reachable from the internet, remove that exposure.
• Are there legacy Exchange servers still running that are no longer actively used? Old servers left powered on are a persistent risk. If a server is not needed, decommission it.

If your organisation is running on-premises Exchange and you have been considering a move to Microsoft 365, this is a prompt worth taking seriously. Our cloud migration team can walk through the options and costs with no obligation. Many businesses find that moving to Exchange Online removes entire categories of on-premises patching risk for good.

For those who need to keep Exchange on-premises, making sure your patch management is timely and your IT security posture is current has never been more important. Patch management alone is not enough — network segmentation, access controls and good logging all contribute to your ability to detect and contain an incident if one occurs.

If you would like help checking your Exchange patch status, applying the update, or reviewing your broader security arrangements, get in touch or call 01452 701355 for a no-obligation conversation.