22,000 Microsoft Exchange Servers Exposed to Auth Bypass Hijack

Tue, 01 Sep 2026 15:28:52 +0000

Engineer — Plan: If you run on-premises Exchange, audit internet-facing instances and apply the patch for this authentication bypass before exposure becomes exploitation; the scale of 22,000 unpatched servers makes this an attractive target even without current KEV or PoC signals.
SOC/IR — Learn: No IOCs or confirmed active exploitation are cited, so there is no hunt to run today; file the attack surface (full mailbox hijack via auth bypass) to inform detection design if exploitation activity emerges.
Leader — Plan: Confirm this quarter whether your organization runs on-premises Exchange and whether it is patched; the breadth of exposed servers (22,000 globally) makes this a likely board or customer question if exploitation picks up.

Exchange-Server on CuraSec