A weaponized, credential-free exploit for the Microsoft Exchange vulnerability CVE-2026-62911 has been posted to GitHub, and security researchers warn that more than 21,000 servers remain exposed as of late August 2026. Shadowserver Foundation’s daily scans counted 21,899 unpatched Microsoft Exchange servers worldwide on August 31, every one of which grants an attacker unauthenticated access to every mailbox it hosts. The disclosure comes roughly three weeks after Microsoft shipped its patch, and the window for mass exploitation has now fully opened.
No Patch Path for a Large Share of Affected Servers
The exposure is compounded by a structural problem in Microsoft’s product lifecycle. Organizations still running Exchange 2016 or Exchange 2019 that have not enrolled in Microsoft’s paid Extended Security Update program have no supported patch path at all. The Extended Security Update program itself expires permanently in October 2026, which means even paying customers will move into a structural zero-day window regardless of how urgently their administrators respond. There is no workaround available through the Exchange Emergency Mitigation Service. The only remediation is the patch, and for a substantial portion of the installed base, that patch no longer exists.
Government Agencies Confirm Active Exploitation Risk
Two European cyber security agencies updated their advisories within the past week to reflect the gravity of the situation. The Netherlands National Cyber Security Centre confirmed on August 28 that functional exploit code is now publicly circulating. Germany’s Federal Office for Information Security reported that 85 percent of the country’s Exchange fleet remains unpatched, a figure representing roughly 20,000 servers in a single country. CERT-Bund has been notifying affected German network operators directly since August 14, underscoring how concentrated the exposure is in organizations that have not yet acted.
How the Microsoft Exchange Vulnerability Works
CVE-2026-62911 is classified as an authentication bypass by capture-replay, tracked under CWE-294, and carries a CVSS 3.1 score of 8.0 from Microsoft and 8.1 from the Zero Day Initiative. The flaw resides in Exchange’s Mailbox Replication Proxy Service, the MRSProxy component that handles mailbox moves between organizations. Exchange exposes MRSProxy through two distinct paths that do not behave the same way. The IIS-hosted path at /EWS/MRSProxy.svc correctly enforces Extended Protection for Authentication, a security mechanism that binds authentication sessions to the underlying TLS channel through a cryptographic hash of the server certificate. A second path, hosted directly on Windows’ HTTP.sys networking stack, skips channel-binding validation entirely, making it an open relay target.
From Relay to Full Mailbox and System Compromise
Extended Protection for Authentication works by incorporating the server’s TLS certificate fingerprint into the authentication exchange. When EPA is enforced, an attacker who intercepts a valid NTLM authentication handshake cannot forward it to a different server or endpoint because the credential is cryptographically bound to the specific channel it was created for. The HTTP.sys MRSProxy endpoint’s missing enforcement creates a structural NTLM relay target. An attacker who can coerce an Exchange server into authenticating outbound using PetitPotam-style MS-EFSR RPC calls can capture that machine-account NTLM handshake and relay it to the unprotected endpoint. Exchange machine accounts hold the ms-Exch-EPI-Token-Serialization privilege by default, which grants full WCF service access. From that position, the attacker reaches a WCF service method that accepts a file path parameter and writes an ASPX webshell to disk as SYSTEM. The end state is total mailbox access and arbitrary code execution on infrastructure that typically authenticates every user in the organization and holds membership in the high-privilege Exchange Windows Permissions Active Directory group.
Pwn2Own Pedigree and ProxyLogon History
The vulnerability was discovered by Orange Tsai of the DEVCORE Research Team and demonstrated at Pwn2Own Berlin on May 15, 2026, as one link in a three-bug chain that achieved remote code execution as SYSTEM on a fully patched Exchange server. The complete chain earned $200,000 and 20 Master of Pwn points, the highest single-target award at the event. Orange Tsai is the same researcher who discovered ProxyLogon in 2021, the foundational Exchange vulnerability that enabled HAFNIUM and subsequent ransomware groups to compromise tens of thousands of servers before most organizations were aware the flaw existed. The Pwn2Own origin matters because it means CVE-2026-62911 was live-proven, not theorized, against fully updated software under competition conditions before any patch existed.
Public Exploit Closes the Gap Between Disclosure and Mass Risk
Microsoft formally disclosed the vulnerability and shipped the patch on August 11, 2026, as part of its regular monthly security update cycle. The advisory carried a risk designation of Exploitation Less Likely, a rating set at patch release when no public exploit code existed. That rating has not been updated since, despite the proof-of-concept publication. The Zero Day Initiative, which received the disclosure through the Pwn2Own process, disputed Microsoft’s framing as understating the practical attack surface. On August 27, 2026, researcher Nguyen Van Hiep published a working proof-of-concept exploit on GitHub. The repository header states plainly that the tool provides pre-authentication remote code execution on Microsoft Exchange Server with no credentials required. With more than 21,000 unpatched servers confirmed worldwide, 85 percent of Germany’s Exchange fleet still vulnerable, and a no-credentials exploit now downloadable by anyone, the Microsoft Exchange vulnerability has moved from theoretical risk to immediate operational crisis for organizations that have not yet patched.
Security teams are being urged to treat the situation as a priority-one incident, beginning with immediate identification of all on-premises Exchange deployments and the application of the latest cumulative update alongside the dedicated mitigation released by Microsoft. Network defenders should also hunt for indicators of compromise tied to the published proof-of-concept code, including suspicious web requests to Exchange services, unexpected processes spawned by the IIS worker, and outbound connections from servers that should not initiate external traffic. Air-gapping vulnerable servers where possible, enforcing strict segmentation between Exchange and the rest of the corporate environment, and reviewing backup integrity are recommended stopgap measures while patches are deployed. Federal cybersecurity agencies in both the United States and the European Union have echoed these recommendations, warning that state-sponsored actors and financially motivated criminals alike are likely to weaponize the flaw within days rather than weeks. Organizations that continue to delay remediation should expect ransomware deployment, data exfiltration, and potential lateral movement into adjacent business systems as the most probable outcomes of leaving the Microsoft Exchange vulnerability exposed on internet-facing infrastructure.