# Nearly 22,000 exposed Exchange servers remain unpatched for mailbox-takeover flaw

_Published Tuesday, September 1, 2026 at 10:07 AM EDT · Security · Latest · Tier 1 — Major_

![Nearly 22,000 exposed Exchange servers remain unpatched for mailbox-takeover flaw — Primary](https://www.bleepstatic.com/content/hl-images/2025/03/14/Exchange-Online.jpg)

Nearly 22,000 internet-exposed Microsoft Exchange servers remain unpatched for CVE-2026-62911, a high-severity authentication-bypass flaw that can let an authorized attacker take over users' mailboxes, according to Shadowserver data cited by BleepingComputer. Microsoft issued fixes in August. The Netherlands' National Cyber Security Centre says exploit code is available online, while Microsoft has not confirmed exploitation in the wild. Germany's BSI has also warned that many on-premises Exchange servers in the country remain vulnerable.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/)
- [Help Net Security](https://www.helpnetsecurity.com/2026/09/02/microsoft-exchange-cve-2026-62911-critical-authentication-bypass-flaw/)

---
Canonical: https://techandbusiness.org/newswire/2xqVuywhLWaa-e3jKmhD2K
Published: 2026-09-01T14:07:25.422Z
Story chronology: 2026-09-01T12:38:35.000Z
Retrieved: 2026-10-17T03:10:49.687Z
Publisher: Tech & Business (techandbusiness.org)