Critical Authentication Bypass (CVE‑2026‑62911) Leaves Nearly 22,000 On‑Premises Microsoft Exchange Servers Exposed
What It Is – A critical authentication‑bypass flaw (CVE‑2026‑62911) in Microsoft Exchange Server 2016/2019 that lets an attacker capture and replay credentials to elevate privileges across the network.
Exploitability – Microsoft issued a patch on 8 Nov 2026; the National Cyber Security Centre (Netherlands) reports a working exploit is already circulating. CVSS 8.0 (critical).
Affected Products – Microsoft Exchange Server 2016 and 2019 (on‑premises installations, including those covered only by the Extended Security Updates (ESU) program).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls remain effective and patched – a core control objective across NIST CSF, ISO 27001, and other frameworks.
- Unpatched servers erode audit‑ready evidence of “secure configuration” and can invalidate compliance attestations that rely on up‑to‑date security baselines.
- Enterprise buyers increasingly demand proof that identity and access management (IAM) controls are continuously monitored and that remediation evidence is readily available.
Recommended Actions
- Deploy Microsoft’s September 2026 security update to all Exchange 2016/2019 instances immediately.
- Verify ESU eligibility; if a server is out of support, migrate to a supported platform or isolate it from external networks.
- Enable continuous patch‑compliance monitoring to surface any lingering unpatched Exchange assets.
- Review authentication logs for anomalous replay activity and enforce multi‑factor authentication for privileged Exchange accounts.
Source: Help Net Security