![\"Hundreds](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/09\/1788845534_379_ImageResizer.ashx.jpeg\")
<\/p>\nKey points<\/p>\n
382 Australian and 56 New Zealand Exchange servers remain vulnerable to CVE-2026-62911 as of August 31, three weeks after Microsoft’s fix.
\nWorking exploit code is now publicly available, and NCSC-NL warns an unauthenticated attacker could potentially achieve arbitrary code execution.
\nASD is urging organisations still running legacy Exchange versions to act, or segment networks if replacement isn’t possible.<\/p>\n
<\/p>\n
Unpatched and ancient Microsoft Exchange servers that are vulnerable to a critical authentication bypass vulnerability are rife on Australian and New Zealand networks, putting organisations’ mailboxes in risk of full compromise.<\/p>\n
Worse, there is now working exploit code publicly available for the vulnerability.<\/p>\n
Security monitoring nonprofit ShadowsServer Foundation counted 382 Australian and 56 New Zealand Exchange servers still vulnerable to CVE-2026-62911 as of August 31, three weeks after Microsoft released a fix.<\/p>\n
The affected versions are the older Exchange Server 2016, 2019, and Subscription Edition, which compound the patching problem.<\/p>\n
Exchange 2016 and 2019 now receive security updates only through Microsoft’s Extended Security Updates (ESU) program.<\/p>\n
This means organisations running those versions are paying for continued support on infrastructure they have not yet replaced or migrated to cloud-hosted Exchange.<\/p>\n
The Netherlands’ National Cyber Security Centre (NCSC-NL) said<\/a> on August 28 that proof-of-concept exploit code had appeared online.<\/p>\n NCSC-NL upgraded its advisory and warned that an unauthenticated attacker could potentially achieve arbitrary code execution.<\/p>\n Microsoft has not yet confirmed active exploitation in the wild, and the flaw does not yet appear in the United States Cybersecurity and Infrastructure Agency’s Known Exploited Vulnerabilities (CISA-KEV) catalogue.<\/p>\n The flaw is rated as CVSS 3.1 score of 8 out of 10, and allows an attacker to intercept authentication traffic and replay it to gain elevated privileges on an Exchange server.<\/p>\n Microsoft said a successful attacker “would be able to take control of the mailboxes of all Exchange users” and could send, read and download attachments from any account on the system.<\/p>\n The vulnerability was discovered by Orange Tsai<\/a> of the DEVCORE Research Team during the Pwn2Own Berlin 2026 contest.<\/p>\n Asked about the vulnerability by iTnews, the Australian Signals Directorate (ASD) encouraged organisations still running legacy Exchange to act.<\/p>\n “Legacy technology that can no longer receive important security updates and patches are an easy target for malicious actors and are more vulnerable to cyberattacks,” an ASD spokesperson said.<\/p>\n The directorate also advised that where legacy systems cannot be replaced, organisations should segment networks to protect their most critical systems, ASD added.<\/p>\n ASD maintains standing guidance on Exchange Server security hardening<\/a> and end-of-support planning.<\/a>\u00a0<\/p>\n Globally, ShadowServer counted 21,899 vulnerable Exchange servers as of August 31 2026, suggesting the slow patching and upgrading isn’t unique to the Oceania region.<\/p>\n","protected":false},"excerpt":{"rendered":"Key points 382 Australian and 56 New Zealand Exchange servers remain vulnerable to CVE-2026-62911 as of August 31,…\n","protected":false},"author":2,"featured_media":884081,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":["post-884080","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/884080","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=884080"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/884080\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/884081"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=884080"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=884080"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=884080"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}