Capture-replay is the mechanism. It sets the entry price. Microsoft's wording is that an authorized attacker elevates privileges over a network [3], and BleepingComputer's read of the advisory adds low attack complexity plus a user interaction requirement, with the attacker holding basic privileges on the target [6]. Exploitation starts from a foothold, not from a blank internet scan. The payoff is what makes that foothold worth buying: read and send access across every mailbox on the server, attachments included [4].
The counting deserves care, because two numbers are being read as one. Shadowserver counts IP addresses carrying an Exchange fingerprint that are unpatched and reachable [9]. The United States and Germany contribute 6,200 and 5,100 [11], which is 11,300 between them, or 51.6 percent of the total [1]. Germany's BSI posted on August 28 that about 85 percent of the country's on-premises Exchange servers remain vulnerable [14], a measurement of all installs rather than the internet-facing subset. Forcing the two together would put Germany's exposed fleet near 6,000 [3]; the numbers add up, but they are counting two different populations.
The timeline matters too. From the August 11 fix [1] to Shadowserver's September 1 figure [10] is 21 days [2]. Exchange 2016 and 2019 receive these updates only through the Period 2 ESU program, which stops shipping in October 2026 [15]. That is roughly two months after this patch [4], so for two of the three affected versions the patch route closes well before the unpatched population is likely to move. NCSC-NL writes its guidance on that assumption, telling 2016 and 2019 operators to keep the server reachable only internally and to replace it where possible [16].
Zscaler's post on the bug, which recommends its own private access product [19], hangs the urgency on frontier AI models generally and on its own report's claim that mean-time-to-exploit has gone negative [19]. That framing borrows its urgency from Zscaler's broader trend claims rather than from anything confirmed about this specific bug. NCSC-NL says working exploit code is already circulating [12], Microsoft's advisory has not confirmed it [12], and CISA had not reported in-the-wild exploitation at the time of Zscaler's writing [13]. The operative question is who already holds a low-privilege mailbox on one of these servers rather than who can write the exploit, and OWA needing to be reachable by design keeps that population large [20].
The campaign history is the reason to read the gap as a schedule rather than a severity score. CISA has added 20 Exchange Server vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021, 14 of them also flagged as abused in ransomware [17]. The most recent, CVE-2026-42897, was exploited in cross-site scripting attacks against Outlook Web Access users and patched in June [18].
