# Twenty-Two Thousand Reasons Microsoft Exchange Is Still a Hacker's Favorite Target


The patch has been available. The vulnerability is well-documented. The attack surface is trivially discoverable via Shodan. And yet, as of this week, nearly 22,000 Microsoft Exchange servers sitting open to the internet remain unpatched against a high-severity authentication bypass flaw that hands an attacker every mailbox in the organization — no credentials required.


This is not a zero-day story. It's a patch fatigue story, and it's one the enterprise security world keeps failing to learn.


## What the Flaw Actually Does


The vulnerability in question is an authentication bypass affecting on-premises Exchange Server deployments. Exploitation lets an unauthenticated remote attacker impersonate any user on the system — including administrators — and then pivot to reading, sending, deleting, or exfiltrating email at scale. Every mailbox. Every draft. Every confidential attachment sitting in a CFO's inbox.


The "authentication bypass leading to full mailbox access" pattern has a specific technical flavor in Exchange's history: it typically abuses the server's own privileged local account or exploits the way Exchange handles NTLM relay or EWS (Exchange Web Services) requests to promote an attacker to SYSTEM-level privileges. Once you have that, Exchange's own APIs become your toolset.


The result isn't just credential theft. It's organizational transparency — attackers can read communications silently for weeks before anyone notices, a capability intelligence operations and ransomware affiliates both find extremely useful.


## Why 22,000 Servers Are Still Exposed


That number — 22,000 internet-facing Exchange servers unpatched against a high-severity flaw — sounds shocking. It isn't, really. It fits a pattern that has repeated itself with depressing consistency since ProxyLogon in 2021.


On-premises Exchange administrators are in a peculiar bind. Exchange patching is notoriously painful. Cumulative Updates often require hours of maintenance windows, prerequisite software installations, and post-patch validation that touches Active Directory, IIS, and the Windows certificate store. In organizations with small IT teams — regional law firms, mid-market manufacturers, healthcare networks running legacy integrations — the calculus often becomes "patch it next quarter when we have a change window."


Next quarter becomes next year.


Meanwhile, threat actors automate. Within days of a high-severity Exchange CVE dropping, mass-scanning operations are running across every reachable IP, fingerprinting Exchange versions and probing for the specific flaw. The window between "patch released" and "active exploitation at scale" has compressed to less than a week in several recent incidents. Defenders who aren't moving in that window aren't winning the race.


## A Brief History of Exchange as a Breach Vector


If this feels familiar, it should. The Exchange ecosystem has been a recurring entry point for some of the most consequential intrusions of the past five years:


2021 — ProxyLogon (CVE-2021-26855): Four chained zero-days, attributed initially to Hafnium, a Chinese state-sponsored group. Tens of thousands of organizations compromised globally before patches even existed. CISA issued an emergency directive. The FBI later remotely removed web shells from victim servers under a court order — an extraordinary step.


2022 — ProxyNotShell (CVE-2022-41040 / 41082): Another authentication bypass plus remote code execution chain. Microsoft delayed patching and offered a flawed mitigation that security researchers quickly bypassed.


2023 — Multiple Exchange Server CVEs: At least four separate high-severity vulnerabilities patched in a single Patch Tuesday cycle, reflecting continued architectural debt in the product.


The throughline: Exchange Server's on-premises codebase is enormous, complex, and deeply integrated with Windows internals. That complexity generates vulnerabilities. The organizations running it on-premises are, almost by definition, those without the resources or appetite to move to Exchange Online — which means they're also the ones least likely to have a dedicated patching cadence.


## The Intelligence Value of an Email Server


It's worth being explicit about what an attacker gets when they own an Exchange server, because "mailbox access" undersells it.


Email is the connective tissue of organizations. A compromised Exchange deployment gives attackers:


  • Pre-attack reconnaissance: Vendor relationships, contract terms, security vendor names, IT contact details
  • Credential harvesting opportunity: Password reset emails, MFA enrollment confirmations
  • Social engineering material: Internal voice and tone, ongoing negotiations, personnel conflicts
  • Lateral movement pivot: Exchange servers typically hold service account credentials and have privileged network positions
  • Persistence: Web shells dropped on Exchange IIS instances are notoriously hard to detect and clean

    • Nation-state actors don't just grab data and run. They read email silently for months. The 2021 SolarWinds-adjacent Exchange intrusions demonstrated exactly this — attackers used compromised Exchange environments to surveil targets without triggering any alerts.


    ## What Defenders Need to Do Now


    If you're running on-premises Exchange and haven't applied recent Cumulative Updates and Security Updates:


    Immediately:

  • Run Get-ExchangeDiagnosticInfo or check the Exchange build number against Microsoft's published patched versions
  • Pull the server off public internet access if patching can't happen within 48 hours — VPN-only access for Exchange is painful but preferable to being owned
  • Review IIS logs for unusual POST requests to /autodiscover, /ews, or /owa endpoints — these are common exploitation paths

    • Within the week:

  • Apply the current Cumulative Update chain and all applicable Security Updates
  • Enable Extended Protection for Authentication if not already active (Microsoft has made this a patching prerequisite in recent updates)
  • Audit service accounts with Exchange permissions

    • Structurally:

  • Seriously evaluate Exchange Online migration. The on-premises product is in security debt. If your organization's Exchange footprint is small enough to move, the patching overhead no longer makes sense.

    • ---


    ## HackWire Analysis


    The 22,000-server figure from this week's scan data is a number that deserves more anger than it typically gets.


    We've now had five-plus years of high-profile Exchange Server compromises. We've had CISA emergency directives, FBI court orders to remotely remediate servers, congressional inquiries, and repeated "wake-up call" coverage across every major security outlet. And still: twenty-two thousand servers, internet-exposed, unpatched against a flaw that allows complete mailbox takeover.


    The coverage cycle around Exchange vulnerabilities has developed a predictable shape: CVE drops, researchers note the severity, reporters write the "patch now" piece, organizations that can patch quickly do, and the rest drift. In three to six months, someone publishes scan data showing the long tail of unpatched deployments, everyone expresses dismay, and the cycle resets.


    What's missing from most of this coverage is accountability for *why* the long tail exists and what would actually shorten it. The answer isn't "organizations need to take patching more seriously." That's true but useless. The answer is structural: on-premises Exchange patching is genuinely hard, Microsoft's patching communication has historically been poor (recall the ProxyNotShell mitigation debacle), and the organizations most exposed are precisely those with the fewest security resources.


    The harder question no one is pressing Microsoft on: why does an email server designed to handle an organization's most sensitive communications have an architectural surface area this large? Exchange Online doesn't have this problem because the patching responsibility has shifted. The continued existence of a massive on-premises installed base with documented, repeat vulnerability patterns is a product design problem as much as an operations problem.


    For defenders stuck with on-premises Exchange: the threat actors scanning for this flaw right now are not being patient. Treat internet-exposed Exchange as a perimeter device — because that's exactly how attackers see it.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)