Twenty-one thousand, eight hundred and ninety-nine. That is the number of Microsoft Exchange Servers exposed to the internet as of August 31st, 2026. In Germany, the figure is worse: 85% of local deployments remain unpatched. This is not a vulnerability report. This is a structural audit of a legacy architecture failing in real-time.
CVE-2026-62911 is not another ProxyLogon. It is a distinct class of failure—a dual-path architecture flaw in the MRSProxy service that reveals how technical debt compounds into systemic risk. The patch exists. The problem is that patching is not the bottleneck. The bottleneck is architectural.
The Architecture of Neglect
Exchange Server is a 20+ year old codebase. It carries the scars of every feature added, every performance optimization, and every security fix bolted on after the fact. The MRSProxy vulnerability is a textbook case of what happens when security standards are not applied uniformly across a system's evolution.
The flaw lives in two paths. One path, /EWS/MRSProxy.svc, is hosted by IIS and protected by Extended Protection for Authentication (EPA). The other, /Microsoft.Exchange.MailboxReplicationService.ProxyService, is hosted by HTTP.sys and lacks EPA entirely. Same service. Same data. Different security postures.
This is not an oversight. This is a timeline artifact. The HTTP.sys path was likely introduced as a performance bypass—a faster route for mailbox replication traffic. It was built by a different team, in a different era, under different security requirements. The security review did not keep pace with the optimization. The result is a backdoor that was never intended to be one.
Orange Tsai demonstrated the full chain: authentication bypass to SYSTEM-level code execution via a WCF method that writes an ASPX webshell. The attack chain is complete. This is not a theoretical vulnerability. It is weaponized.
The Patch Gap
Microsoft released KB5121573 through KB5121576, covering multiple versions. Exchange 2016 requires an Extended Security Update (ESU), which ends in October 2026. After that, no more patches. The message is clear: migrate or be exposed.
But here is the structural problem. The patch distribution mechanism assumes a capability that most organizations do not possess. The 85% unpatched rate in Germany is not a failure of German IT teams. It is a failure of the entire on-premises software model. Patch deployment requires testing, change management, and rollback planning. The average enterprise takes four to eight weeks to deploy a critical patch. The PoC was public within days of the patch release. This is a race the defense always loses.
I have seen this pattern before. In 2017, I audited ICO smart contracts that had similar dual-path flaws—one function protected, another exposed. The teams always believed the exposed path was internal-only. The teams were always wrong. The same logic applies here. The HTTP.sys path is reachable from the internet. The Shadowserver data only counts directly exposed IPs. The real attack surface is larger.
The Migration Calculus
Microsoft's strategy is not subtle. The ESU timeline, the reduced investment in on-premises security, the relentless messaging about M365—all of it points to one conclusion: Microsoft is using security as a migration catalyst. This is not a conspiracy. It is a business model. The on-premises product is in maintenance mode. The cloud product is the future. Every vulnerability in Exchange Server is a sales pitch for Exchange Online.
This creates a perverse incentive structure. Microsoft controls the security investment in the legacy product. The less secure the legacy product appears, the faster customers migrate. I do not trust the pitch; I audit the structure. The structure here is clear: the security of on-premises Exchange is being deliberately managed to a level that is just good enough to avoid catastrophic liability, but not good enough to retain customer confidence.
The ESU model is the bridge. It converts security maintenance from a perpetual license entitlement into a subscription. It trains customers to pay for security as a service. It is the intermediate step between on-premises ownership and cloud rental. The customer pays for the privilege of staying on a dying platform, then pays again to migrate off it.
What the Bulls Got Right
I do not trust the pitch; I audit the structure. But the structure has one undeniable strength: switching costs. Exchange Server is deeply embedded in enterprise infrastructure. Mailboxes, calendars, contacts, integrations—migrating is a multi-year project with real risk of data loss and business disruption. This is the moat. It is also the cage.
The moat protects Microsoft's market share. It does not protect the customer. The customer is locked into a platform that is increasingly insecure, with a vendor that has a financial incentive to make the legacy product less attractive. The rational response is not to stay or leave. It is to recognize that the decision is not between Exchange and a competitor. It is between on-premises and cloud. The cloud wins by default, not by merit.
The Accountability Gap
The regulatory response has been uneven. NCSC-NL issued a confirmation. BSI provided quantitative data. CISA listed the vulnerability as "none" for active exploitation. Three agencies, three different assessments of the same threat. This inconsistency reflects the information asymmetry in the disclosure ecosystem. Microsoft rates the exploitability as "Less Likely." ZDI publicly disputes this. The truth is somewhere in between, and no one is accountable for the gap.
Emotion is a variable I exclude from the equation. The equation here is simple: 21,899 exposed servers, 85% unpatched in Germany, ESU ending in October 2026, and a public PoC. The variables are known. The outcome is predictable. Some of these servers will be compromised. Some of those compromises will result in data breaches. Some of those breaches will trigger GDPR fines for "failure to implement appropriate technical measures." The fine will be larger because the vulnerability was known and unpatched.
The Only Question That Matters
The patch window is closing. The ESU window is closing. The migration window is closing. The only question that matters is not whether your Exchange server will be compromised. It is whether you can prove you took reasonable steps to prevent it. Documentation is your only defense. Patch records, risk assessments, deployment logs—these are the artifacts that will determine your liability.
Liquidity is a mirage; solvency is the only truth. In security, the equivalent is: urgency is a mirage; preparedness is the only truth. The 21,899 exposed servers are not a statistic. They are a liability ledger. The question is whether you are on the asset side or the liability side of that ledger. The answer is determined by what you do in the next 30 days, not what you plan to do in the next quarter.
The architecture failed. The patch exists. The responsibility is yours.
