A capture-replay auth bypass leaves 22,000 Exchange servers exposed

August 11, 2026. Microsoft discloses CVE-2026-62911, an authentication bypass by capture-replay in Exchange Server, rated CVSS 8.0. August 28, 2026. Germany’s BSI estimates roughly 85% of on-premises Exchange servers in the country — about 5,100 machines — are still unpatched. August 31, 2026. Shadowserver counts 21,899 internet-facing Exchange IP addresses as exposed. Why it matters: the fix has been out for three weeks, a public PoC is circulating, and a whole slice of the fleet — Exchange 2016 boxes without an ESU contract — has no update path at all.

The mechanism: replaying a captured authentication

The flaw falls under CWE-294, “authentication bypass by capture-replay.” In practice, an attacker who already has limited access to the server can capture a legitimate authentication exchange and replay it to impersonate a more privileged user. The CVSS 3.1 vector spells it out: network, low attack complexity, low privileges required, user interaction required, and high impact on confidentiality, integrity and availability.

The “user interaction required” nuance matters. The replay assumes a victim authenticates through a path the attacker can observe or steer — typically an NTLM-style relay, where the attacker sits between a client and the server. The resulting privilege escalation turns basic access into mailbox compromise: reading inboxes, exfiltrating email, and a foothold at the heart of the corporate directory.

The fix has shipped since August 11, 2026, via KB5121574 for Exchange Server 2019 CU15 and KB5121575 for Exchange Server 2019 CU14. Earlier branches and Exchange Server 2016 CU23 are also affected, but their situation is different — more on that below.

One link in a Pwn2Own Berlin chain

CVE-2026-62911 did not surface in isolation. It was part of the demonstration chain presented by Orange Tsai and DEVCORE at Pwn2Own Berlin 2026, the exploit contest where researchers sell working exploits under controlled terms. That this flaw served as a link in a full chain is telling: on its own it escalates privileges; chained with others, it contributes to end-to-end compromise.

That origin has two consequences. First, the quality of the analysis — a flaw demonstrated under real conditions by well-known researchers is not a speculative advisory. Second, the spread of knowledge: after the contest, technical details began to circulate, and a public PoC has been reported on GitHub. The window between “fix available” and “exploit widely accessible” closed within days.

22,000 exposed servers, a public PoC

The numbers capture the inertia. By August 31, 2026, Shadowserver had identified 21,899 exposed or unpatched Exchange IP addresses on the internet. Germany’s BSI, which has been notifying network operators directly since August 14, 2026, estimated on August 28 that about 85% of the country’s on-premises Exchange installs — 5,100 servers — had still not applied the update. The Dutch NCSC confirmed a working exploit was in circulation.

This lag is no curiosity. An exposed mail server is a prime target: it concentrates credentials, sensitive data and privileged access to the directory. A public PoC, an exposed surface in the tens of thousands of addresses, and delayed patching together reproduce the classic pattern of the ProxyLogon and ProxyShell campaigns of 2021, where mass exploitation followed the release of technical details.

Detecting a replayed authentication

The good news for defenders is that capture-replay is not stealthy by nature. A replayed authentication leaves the same signature as a classic NTLM relay attack: a privileged account authenticating from an unexpected source, or a session established without the corresponding interactive login. Watch the event logs for a mailbox accessed by an account whose authentication came from a machine it never normally logs in from, and correlate with the msExch non-owner-access audit paths.

The detection loop is simple. Enable mailbox-audit logging for non-owner access, alert on any administrative account whose mailbox is opened by a delegate, and treat any NTLM authentication flowing over a path where it has no business — an internet-facing endpoint, a relay-sensitive service — as a replay candidate. Organizations that have already replaced NTLM with Kerberos are substantially less exposed to this class of flaw, which makes it the strongest single mitigation beyond patching.

The Exchange 2016 trap: a population that cannot patch

The most structural point is not the flaw itself but the lifecycle. Exchange Server 2016 reached end of support in October 2025. Since then, post-support security updates depend on Extended Security Updates (ESU) eligibility — a paid contract that not every organization signed. The result: an organization still on Exchange 2016 without ESU coverage cannot simply “apply the patch”; it must either enroll in ESU or migrate.

That is exactly what makes CVE-2026-62911 more dangerous than its score suggests. A meaningful share of the exposed fleet has no trivial update path. The BSI notifying operators directly is a sign that standard advisory channels no longer move the affected population. For an organization subject to NIS2, running unpatched, unsupported mail infrastructure also carries accountability under vulnerability-management obligations.

Patch, or migrate

The first action depends on your branch. If you are on Exchange Server 2019, apply KB5121574 (CU15) or KB5121575 (CU14) now: the fix is out, the PoC is public, and active exploitation is plausible. Then check authentication logs for signs of earlier replay — a successful escalation rarely leaves the server untouched.

If you are on Exchange Server 2016, the question is not the patch. Assess your ESU eligibility immediately: if valid, enroll and apply the update; if not, the only risk-reduction path is migration to a supported branch or a managed service. In the meantime, shrink the surface: remove direct internet exposure, restrict access behind a VPN or gateway, and harden authentication protocols to limit replay.

Beyond the one-off fix, the lesson is about lifecycle. A mail-server flaw does not wait for end of support to be exploited. Migration decisions made years earlier get paid, at the moment of an incident, in days of open window.

Verdict

If you are on Exchange 2019, patch today with KB5121574 or KB5121575: the PoC is public, the exploitation window is open, and a replay-based escalation leaves no encryption to break.

If you are on Exchange 2016 without ESU, stop looking for a patch — there isn’t one. Enroll in ESU if eligible, otherwise start the migration to a supported branch, and cut internet exposure immediately.

Either way, do not size your exposure by the CVSS 8.0 score alone: it is the combination of the public PoC and the unpatchable population that turns this flaw into a potential campaign.

References

• NVD — CVE-2026-62911
• Microsoft — CVE-2026-62911 Exchange Server Elevation of Privilege
• BleepingComputer — Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
• Help Net Security — Microsoft Exchange CVE-2026-62911 critical authentication bypass flaw, September 2, 2026
• SentinelOne — CVE-2026-62911 vulnerability database entry