Nearly 22,000 Microsoft Exchange Servers Remain Exposed to Critical Authentication Bypass Vulnerability (CVE-2026-62911)

Despite a fix released on August 11, 2026, a critical authentication bypass vulnerability (CVE-2026-62911) in Microsoft Exchange Server continues to expose nearly 22,000 servers globally, with a working exploit now circulating online. CISA has also added seven new vulnerabilities, including Sangoma Switchvox SQL Injection (CVE-2026-9586), to its Known Exploited Vulnerabilities Catalog, urging organizations to prioritize remediation.