Affected Systems
Microsoft Exchange Server 2016, 2019, and Subscription Edition (SE). Approximately 21,899 internet-exposed servers remain unpatched globally, with highest concentrations in the United States (6,200) and Germany (5,100). Exchange 2016 and 2019 only receive updates via Extended Security Updates (ESU) program, ending October 2026.
Exploitation Status
Public exploit code is available online (confirmed by NCSC-NL). No confirmed active exploitation in the wild as of publication date. However, 20 prior Exchange vulnerabilities have been exploited since 2021, 14 in ransomware campaigns.
Business Impact
Authenticated attackers with basic privileges can hijack all user mailboxes on vulnerable Exchange servers via low-complexity capture-replay attacks requiring user interaction. Full compromise includes ability to send, read, and exfiltrate emails and attachments for all users. Given public exploit availability and large attack surface (22K exposed servers), exploitation risk is elevated. Germany's BSI reports 85% of on-premises Exchange servers in Germany remain vulnerable.
Urgency
🔴 Immediate
Recommended Actions
- Apply Microsoft August 2026 Patch Tuesday updates for Exchange Server 2016, 2019, and SE immediately. Verify ESU subscription status for 2016/2019 versions.
- Identify and inventory all internet-facing Exchange servers using network scanning. Restrict Exchange Server 2016/2019 access to internal networks only via firewall rules.
- Monitor Exchange IIS logs and authentication logs for anomalous capture-replay patterns, focusing on repeated authentication attempts from single sources.
- Prioritize migration from Exchange 2016/2019 to Exchange SE or Exchange Online before ESU program ends in October 2026.
- Review mailbox access logs for unauthorized activity on unpatched servers, particularly focusing on privileged account behavior since August 2026.