Source: Ministry of education information & communication security contingency platform
"" "" ""
| Publication Number | TACERT-ANA-2026090803095050 | Publication Time | 2026-09-08 15:33:51 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-09-08 15:33:51 |
| Impact Level | Medium | ||
| [Subject] 【Vulnerability Alert】Microsoft Exchange Server Contains a High-Risk Security Vulnerability (CVE-2026-62911). Please Confirm and Apply Patches as Soon as Possible |
|||
| [Content]
Forwarded from the National Institute of Cyber Security Cybersecurity Alert NISAC-200-202609-00000007 Researchers discovered that Microsoft Exchange Server contains an Authentication Bypass vulnerability (CVE-2026-62911). An authenticated remote attacker may induce a user to interact with specially crafted content in order to intercept and replay authentication credentials, thereby bypassing the server's authentication mechanism, escalating privileges, and gaining access to user mailboxes on the server. Please confirm and apply patches as soon as possible. Information Sharing Level: WHITE (the intelligence content is information that may be publicly disclosed) |
|||
| [Affected Platform]
Microsoft Exchange Server 2016 Cumulative Update 23 versions prior to 15.01.2507.072 |
|||
|
[Recommended Actions] The official vendor has released a patch for the vulnerability. Please update to the following versions: Microsoft Exchange Server 2016 Cumulative Update 23 version 15.01.2507.072 or later Microsoft Exchange Server 2019 Cumulative Update 14 version 15.02.1544.044 or later Microsoft Exchange Server 2019 Cumulative Update 15 version 15.02.1748.049 or later Microsoft Exchange Server Subscription Edition RTM version 15.02.2562.046 or later For detailed information, please refer to the official advisory. The URL is as follows: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911 |
|||
|
[Reference] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-62911 |
|||