Microsoft addressed CVE-2026-62911 in its August 2026 Exchange security updates. On 28 August, the Dutch NCSC reported that proof-of-concept code was circulating and described unauthenticated remote code execution on vulnerable Exchange Server versions. It warned that an attacker could use this to access mailboxes and continue into the victim's network.
The sources describe the prerequisite differently: Microsoft classifies the issue as an authentication bypass by capture-replay, while the NCSC describes exploitation without authentication. As of 31 August, Shadowserver had detected 21,899 IP addresses fingerprinted as Exchange and still exposed without the fix, according to the report published on 1 September. That is a dated snapshot, not a current count.
A mailbox is also an access vault
The 31 August snapshot counted 21,899 exposed IP addresses, not that many distinct organizations. CVE-2026-62911 affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. The Dutch NCSC says an unauthenticated attacker could run code remotely; Microsoft describes the issue as an authentication bypass by capture-replay. In either case, a vulnerable server reachable by an attacker could expose the organization's mailboxes.
NCSC notes that Exchange Server 2016 and 2019 are end of life and receive security updates only through the ESU program. For servers not covered by ESU, it recommends restricting access to internal networks and planning their retirement. The risk goes beyond message confidentiality: a mailbox often contains reset links, attachments, supplier conversations, and identity evidence, and can become a route into other accounts.
Why the password is not the whole story
A password protects one step of a login. It does not patch a server, revoke an existing session, or prevent a fraudulent forwarding rule. An attack can therefore bypass or move beyond login rather than guess the secret. For a separate look at mailbox impersonation, read our article on business email compromise and executive impersonation.
For a small team, priorities are concrete: know the version and exposure of every server, apply fixes, reduce administrative access, and monitor forwarding, delegation, and rule changes. Our SMB password policy guide helps formalize unique secrets, access, and MFA without confusing those controls with server patching.
A post-patch checklist
- Confirm that the fix is applied to every affected server, including forgotten environments.
- Review unusual logins, elevations, and access to sensitive mailboxes.
- Search for external forwarding rules and recently added delegations.
- Revoke sessions and replace secrets if the logs cannot rule out compromise.
- Enable phishing-resistant MFA for critical accounts and separate administrator accounts from daily work accounts.
The role of a local-first vault
Soclyde does not protect Exchange and does not replace its patching process. It helps prevent a second failure: storing administrator passwords, recovery codes, and supplier access in a shared file or in the mailbox itself.
A unique secret generated and kept in an encrypted local vault makes rotation practical after an incident. Soclyde's password manager security audit guide helps teams review where those secrets live and who can access them.
The takeaway
Email security combines patching, privilege reduction, session monitoring, and unique secrets. Fixing Exchange is essential; knowing what to revoke and where to retrieve replacement access matters just as much. Use our password manager security audit guide to assess how administrator and recovery credentials are stored.
