CVE-2026-62911 in Exchange Server: patch runbook and 22,000 unpatched hosts

Microsoft Exchange Server has a privilege elevation flaw CVE-2026-62911 (authentication bypass, CVSS 8.0), fixed on 11 August 2026. CSIRT.CZ reported roughly 22,000 internet-reachable servers still unpatched, with about 300 vulnerable unique IPs tracked in Czechia.

• CVE-2026-62911 is an Exchange Server auth bypass rated CVSS 8.0
• The fix shipped on 11 August 2026 for four product lines
• CSIRT.CZ: about 22,000 internet-reachable servers remain unpatched
• ZoomEye finds 569,453 Exchange assets, but the CVE is not yet indexed