On-prem Exchange CVE-2026-62911: patch now, ESU clock is running

If you still run on-prem Microsoft Exchange and it is reachable from the internet, treat CVE-2026-62911 as an urgent patch ticket, not a “next maintenance window” item.

Microsoft shipped the fix on August 11, 2026. On September 2, 2026, Help Net Security reported that Shadowserver still saw nearly 22,000 internet-facing servers unpatched (about 6,200 in the United States and about 5,100 in Germany). NCSC-NL flagged that a working exploit is circulating online. That combination (internet exposure plus public exploit material) is how opportunistic scanning turns into overnight compromise.

This is the active CVE and patch urgency piece. If production mail already lives in Microsoft 365 and the old Exchange box is leftover infrastructure, pair this with retiring on-prem Exchange leftovers instead of keeping a vulnerable server “just in case.”

What CVE-2026-62911 is

Microsoft describes CVE-2026-62911 as authentication bypass by capture-replay in Microsoft Exchange Server, allowing an authorized attacker to elevate privileges over a network. MSRC rates it Critical (CVSS base 8.0). Successful exploitation can let an attacker take over Exchange mailboxes: read mail, download attachments, and send as legitimate users.

Microsoft’s August advisory still listed exploit maturity as unproven and did not mark the CVE as exploited in the wild at publication. Treat that as a snapshot, not permission to wait. NCSC-NL’s later warning about circulating exploit code is the operational signal that changes triage for internet-facing hosts. For how we weigh vendor status versus exposure and exploit evidence, see how we triage critical CVEs.

Who is affected and which KBs to install

The August 11, 2026 Exchange security rollup family lists CVE-2026-62911 among the fixed CVEs. Match the KB to the product you actually run:

• KB5121573: Exchange Server Subscription Edition RTM
• KB5121574: Exchange Server 2019 CU15
• KB5121575: Exchange Server 2019 CU14
• KB5121576: Exchange Server 2016 CU23

Confirm the running Exchange build after the update, not just that Windows Update said success. Build numbers on the MSRC page are the check.

The ESU catch for 2016 and 2019

Exchange Server 2016 and 2019 are out of mainstream support. Microsoft’s Period 2 Extended Security Update program covers Critical and Important SUs from May 2026 to the end of October 2026. Period 2 is not automatic if you bought Period 1. Microsoft’s October 2026 ESU reminder is explicit: there is no further extension after October 2026.

Practical split for operators:

• Exchange SE: install KB5121573 through the normal supported channel.
• Exchange 2016/2019 with Period 2 ESU: install the matching August KB now, then treat October as a hard migration deadline, not a soft roadmap date.
• Exchange 2016/2019 without ESU: you do not have a supported patch path for this CVE on those versions. Reduce exposure immediately and accelerate migration to Exchange SE or Exchange Online.

Help Net Security also relayed Germany’s BSI note that around 85 percent of on-prem Exchange servers in that country remained vulnerable to CVE-2026-62911. That is not a reason to assume your region is fine. It is evidence that many shops are still behind.

Do this now

1. Inventory every on-prem Exchange host, including “temporary” hybrid boxes, lab VMs with public NAT, and forgotten secondary sites.
2. Record the exact build and whether the host is internet-facing (OWA, ECP, ActiveSync, Autodiscover, MRSProxy-related endpoints, or any published HTTPS front end).
3. Patch what you can patch today. Install the matching August KB above. For 2016/2019, confirm Period 2 ESU entitlement first, then verify the build after install.
4. If you cannot patch, remove or tightly restrict internet exposure. Prefer internal-only access behind strong authentication and known admin paths. NCSC-NL guidance for older Exchange lines is blunt: keep it internal if possible and replace it.
5. Watch for compromise signals on hosts that were public while unpatched: unexpected ASPX under IIS/Exchange paths, odd w3wp child processes, unfamiliar admin activity, and mail-flow anomalies. If anything looks wrong, preserve evidence and move into incident response instead of “patch and hope.”
6. Put an owner on the October 2026 ESU cliff. After Period 2 ends, 2016/2019 get no further security updates. Staying there is choosing permanent patch debt.

Do not do this

• Do not leave OWA or other Exchange HTTPS endpoints on the open internet “until we finish the migration plan.”
• Do not assume hybrid leftovers are harmless because mailboxes already live in Exchange Online.
• Do not treat MSRC’s early “unproven” exploit maturity as a free pass after national CERTs warn about circulating exploit code.
• Do not enroll in ESU as a substitute for migration. ESU is a bridge through October 2026, not a new support life cycle.

Bottom line

CVE-2026-62911 is patched. Public exploit material is in circulation, and Shadowserver still sees on the order of 22,000 internet-facing unpatched Exchange servers. Patch SE and ESU-covered 2016/2019 hosts now, pull public exposure wherever the patch cannot land, and treat the October 2026 ESU end date as the last supported on-ramp off Exchange 2016 and 2019. If the server should already be gone, finish the decommission instead of patching ghosts forever.