On-prem Exchange CVE-2026-62911: patch now, ESU clock is running
Public exploit code is circulating for CVE-2026-62911, Shadowserver still sees about 22k internet-facing unpatched servers, and Exchange 2016/2019 ESU ends in October 2026.
#exchange
2 articles
Retiring leftover on-prem Exchange after you move to Microsoft 365
Hybrid connectors, old MX records, and ghost servers still cost you money and attack surface long after mail lives in the cloud.