Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks

What happened

Let me check the template file first. The template confirms this is a security type post — same five-section structure, 650-word floor, 750–900 target. Here is the article:

Nearly 22,000 Microsoft Exchange servers remain reachable on the public internet without a patch for a high-severity authentication bypass vulnerability that lets an unauthenticated attacker take over every mailbox on the system. The flaw was disclosed by security researchers, reported by BleepingComputer, and affects Exchange deployments that organizations have not yet updated, leaving a wide and easily enumerable attack surface open to exploitation.

This piece is written for system administrators, IT security teams, and infrastructure owners who run on-premises Microsoft Exchange. If your organization has not audited its Exchange exposure recently, the scale of this problem — nearly 22,000 servers still visible to the internet — means the odds of being one of them are not negligible. What follows explains the vulnerability, who carries the most risk, and the concrete steps you need to take before an attacker does it for you.

How it works

Nearly 22,000 Microsoft Exchange servers exposed to the public internet have been identified as unpatched against a high-severity authentication bypass vulnerability. The flaw allows an attacker to bypass authentication entirely and gain control over all user mailboxes hosted on the affected server. The vulnerability was disclosed publicly and a patch has been made available by Microsoft, yet the count of unpatched, internet-facing servers remains close to 22,000 — a number large enough to represent a significant ongoing threat across organizations worldwide. Security researchers and the reporting at BleepingComputer confirmed the exposure through active scanning of reachable Exchange infrastructure.

The gap between patch availability and adoption is the core problem here. Microsoft Exchange is frequently deployed on-premises by organizations that want control over their own mail infrastructure, and those same environments tend to run with slower patch cycles than cloud-based services. The result is a population of servers that are simultaneously reachable from the internet, running outdated software, and hosting sensitive communications for their entire organization.

Any organization running a self-hosted Microsoft Exchange server that is reachable from the public internet and has not yet applied the available patch is directly exposed. The 22,000 figure reflects servers that researchers were able to identify through internet scanning, meaning attackers using the same scanning tools can build an equivalent list. Small and mid-sized organizations are disproportionately represented in unpatched Exchange populations because they often lack dedicated security teams and run on infrequent maintenance windows.

Why it matters

Sectors that rely heavily on on-premises Exchange for regulatory or compliance reasons — including legal, healthcare, and government — carry particular risk because their mailboxes contain sensitive and often privileged information. An organization does not need to be specifically targeted to be compromised; automated exploitation scripts can sweep through known-vulnerable servers and hijack mailboxes before any human attacker is even involved.

The immediate priority is to confirm whether any Exchange server your organization operates is reachable from the public internet and, if so, whether it has received the patch for this authentication bypass vulnerability. Start with your perimeter: run an external scan or use a network inventory tool to find every Exchange server with port 443 or 25 open to internet traffic. Cross-reference those servers against your internal patch records to confirm update status.

Who is affected

If a server is unpatched and internet-facing, apply the available Microsoft patch immediately and treat that server as potentially compromised pending a log review. Check authentication logs for unexpected access patterns, look for mailbox rules that were not created by their owners, and verify whether any mail forwarding rules have been added to user accounts. If patching immediately is not possible, restricting access to the Exchange server via firewall or VPN to remove it from the public internet is a temporary mitigation that reduces direct exposure while the patch is prepared.

The vulnerability is classified as an authentication bypass, which means an attacker does not need valid credentials to interact with the Exchange server as though they were a legitimate user. Authentication bypass flaws at this severity level typically exploit a flaw in the way the server validates identity tokens, session cookies, or authentication headers — allowing a crafted request to skip the credential-checking step entirely. Once past authentication, the attacker has the same access to mailboxes as an authenticated user, including the ability to read, send, delete, and redirect email.

The high-severity classification reflects both the ease of exploitation — no credentials required — and the scope of impact, since a single server compromise exposes every mailbox it hosts rather than a single account. Exchange servers are high-value targets because they hold not just operational email but also calendar data, contacts, and internal communications that can be used for follow-on attacks like business email compromise or credential harvesting from email threads.

What to watch next

The public reporting does not specify the exact CVE identifier for this vulnerability, the Exchange Server versions affected by version number, or the precise patch release date. It is not confirmed from available sources whether active exploitation in the wild has already been observed, or whether proof-of-concept exploit code has been published that would lower the bar for less sophisticated attackers. The 22,000 server count reflects a point-in-time scan and may not account for servers patched in the days since that measurement was taken.

It is also unclear from available information whether cloud-hosted Exchange Online tenants through Microsoft 365 are affected, or whether the vulnerability is strictly limited to on-premises deployments. Organizations should consult the Microsoft Security Response Center and the original BleepingComputer report directly for the specific CVE, affected build numbers, and any updated exploitation intelligence as it becomes available.