The 85% Unpatched Truth: What German Exchange Servers Reveal About the Death of On-Premises Trust

The numbers do not lie, but they do hide. On August 31st, Shadowserver reported 21,899 Microsoft Exchange Servers exposed directly to the internet. The geographic breakdown was predictable: roughly 6,200 in the United States and 5,100 in Germany, followed by smaller clusters in the UK, Russia, Canada, Austria, and France. But the number that should haunt every CISO is not the 21,899. It is the 85%. On September 1st, the German Federal Office for Information Security (BSI) reported that approximately 85% of local Exchange Servers in Germany remained unpatched against CVE-2026-62911—a critical remote code execution vulnerability disclosed approximately one month earlier. This specific vulnerability targets the MRSProxy component via two distinct architectural paths, enabling authentication bypass and leading to SYSTEM-level code execution. Let me reconstruct the timeline, because chronology is the only reliable map through chaos. When a vulnerability like this is weaponized, the sequence of events determines the magnitude of the damage. First came the disclosure from researchers, including DEVCORE's Orange Tsai, which provided the technical blueprint. Then came the patch release: KB5121573 through KB5121576, covering supported versions of Exchange Server 2016 and 2019. Then came something faster than any enterprise change-management committee on earth—the proof-of-concept published to GitHub, which quickly gathered 160 stars and 27 forks. The architecture flaw at the heart of CVE-2026-62911 is a classic case of technical debt crystallizing under pressure. Analysis of the MRSProxy service reveals two distinct paths. One path—/EWS/MRSProxy.svc—is hosted by IIS and protected by Extended Protection for Authentication (EPA). The second path—/Microsoft.Exchange.MailboxReplicationService.ProxyService—is hosted by HTTP.sys and lacks EPA protection entirely. In my years analyzing infrastructure failures, I have seen this pattern repeatedly: a performance optimization or a parallel implementation introduced without synchronized security review. History is written in blocks, not promises—and the block representing that second path was written without the same rigor as the first. To understand why 85% of German servers remain exposed, one must understand the economics of patch deployment. From my audit experience during previous crisis events—including the 2020 DeFi liquidity stress tests and the broader 2022 market collapses—I have learned that risk management is rarely a matter of technology alone. It is a matter of process capacity. The vulnerability was disclosed. The patch was released. The proof-of-concept appeared almost immediately. Yet the average enterprise change-management cycle for a critical on-premises component like Exchange is four to eight weeks. This assumes that the IT staff have the capacity to test the patch, validate compatibility with their existing integrations, schedule a maintenance window, and execute a rollback plan if something goes wrong. Was the deployment rate in Germany slower than elsewhere? It is possible that Germany's strong data sovereignty requirements have kept more organizations on on-premises infrastructure, and those organizations are often conservative in their patch procedures. It is also possible that a lack of automated patch management tools, combined with the sheer volume of security updates, has created a backlog. The gap between the patch distribution mechanism and the actual deployment capability of the client has been a systemic weakness in the traditional software industry for decades. Most security professionals know that a patched server is safer, but few have the operational bandwidth to patch everything immediately. Volatility is the tax on unverified trust. This axiom holds as true for enterprise software as it does for on-chain liquidity pools. An unpatched Exchange Server is effectively a trust-boundary breach waiting to happen. The fact that CISA has not yet added CVE-2026-62911 to the Known Exploited Vulnerabilities (KEV) catalog and has rated active exploitation as "none" provides some short-term comfort, but the comfort is hollow. The KEV catalog tracks what has been confirmed, not what is possible. Orange Tsai's presentation confirms that the full chain—from authentication bypass to ASPX webshell deployment and SYSTEM-level execution—has been weaponized. Several critical observations about the nature of this vulnerability demand attention. First, the affected servers likely number significantly more than 21,899. Shadowserver's scan references only those servers directly exposed to the internet. Any Exchange deployment behind a VPN, a reverse proxy, or in an internal network is invisible to that scan. The real attack surface is broader by orders of magnitude. Second, the distribution of exposed servers maps closely to Exchange's traditional stronghold markets—mid-to-large enterprises in developed economies. This is where Exchange's market dominance and high switching costs have kept infrastructure alive far beyond its support lifecycle’s sweet spot. What is the net takeaway from a quote of only about 15% patched systems in a leading European economy over one month? A structural failure of the entire security patch chain, not a mere data point. The industry wisdom has always been that patches must be deployed within hours to days for critical vulnerabilities. This episode is evidence that such a timeline is not feasible for a significant portion of the installed base. The structure itself is flawed. Let us scrutinize the assumptions. The common narrative frames this as a race between attackers and defenders. But this framing masks a deeper divergence: the core financial incentives. Microsoft's strategic interest lies not in sustaining the on-premises Exchange product but in accelerating the migration to Exchange Online (Microsoft 365). The company has effectively moved to maintenance mode for the on-premises product. There are no new features coming. The Extended Security Updates (ESU) program, which is the only way to secure Exchange Server 2016 after October 2026, signals a sunset timeline. Exchange Server 2019 will eventually face the same fate. This is not an accident of scheduling. It is a deliberate epoch change. What are the implications of this divergence? Optimize for the narrative? No. The story is not about Microsoft being malicious. It is about the economics of maintaining a 20-year-old codebase against modern adversaries. The natural, financial conclusion is to push customers to the cloud. The ESU is a "security tax" designed to extract value from locked-in customers while simultaneously making the on-premises option less economically attractive than a subscription. This dynamic invites a contrarian interpretation: the real security breakdown lies not in the historical deficiency of one software vendor but in the persistent refusal of enterprises to accept that the on-premises software era is over. Consider the regulatory dimension. GDPR requires appropriate technical measures to protect personal data. An unpatched mail server is a poor defense in case of a breach. If a data leak occurs on an insecure server, the fine will likely be higher than any budget savings achieved by deferring migration or delaying patches. That is the "known vulnerability unpatched" liability that goes from abstract risk to concrete damage in breach scenarios. Meanwhile, the Netherlands' NCSC-NL's advisory was relatively prompt. The BSI provided quantitative context. Patching is the issue throughout the board, but the pattern also reveals an insufficiency in vendor-furnished secure deployment tools and an issue in client-side capability. The PoC's spread on GitHub is an informative tale. At 160 stars and 27 forks, it is not yet a mass campaign. However, it is quickly transforming into a tool for medium-skilled attackers. The imminent threat is not a direct exploit carried out by top-tier APT groups. Rather, it's the commoditization that occurs when these researchers publish their code. Soon, the ransomware ecosystem will adopt this capability into their own playbooks. When that happens, untargeted mass scans will catch numerous low-hanging fruit, a process that may result in international incidents. The standard security metrics often mislead because they measure output, not security. A dashboard showing that 88% of servers have deployed a particular patch is technically accurate, but it misses the laggards. By the time an organization reaches 100% patch coverage on a critical vulnerability, the window of vulnerability may have been open for months. In this case, we are looking at a document that details how the network can be bifurcated. Patch management is the primary control, but monitoring, network segmentation, and incident response readiness fill the gap while waiting for 85% of the fleet to catch up. To provide a technical recommendation: isolate the MRSProxy service if possible, block external access to the unprotected HTTP.sys path using a reverse proxy or firewall rule, and audit any existing webshells or suspicious ASPX files. In emergency cases, disable the susceptible service until the patch can be applied. In the meantime, begin your migration planning. Migration from on-premises infrastructure to cloud services is not just an infrastructure project. It is a risk reduction, provided your identity and data governance are ready for the shift. What we witnessed in Germany is structural, systematic, and predictable. Security updates alone will not be enough to fix it. Let me be direct about my position: I would not sign off, today, on an infrastructure strategy that depends on running Exchange Server on-premises past the ESU end date. Patching is necessary but not sufficient; the 85% figure demonstrates why. Given the lack of control over the vulnerability lifecycle and Microsoft's policy of terminating security for legacy versions, the burden falls on the enterprise to reevaluate its standards. What future is there for self-hosted mail servers in a post-ESU world? The choices for the enterprise are stark: pay the ESU "tax" to keep the legacy system alive until it is fully decommissioned, switch to Microsoft 365, or consider a third-party alternative. The complexity of migrating from on-premises Exchange is the main obstacle. The switching costs are high, and the migration involves not just the mailboxes but identity integration, not just the current state but a historical archive, and interconnections with the rest of the enterprise software ecosystem. This is precisely why an adversary prefers these environments—they persist. The threat is not only from an unpatched system, but also from an entire architecture that persists because it was never adequately maintained. A patch is a point fix; an architectural change is a structural fix. For the majority of enterprises, the latter is long overdue. In my previous postmortems, I've seen the critical difference between organizations that treat security as a compliance issue and those that treat it as a risk management exercise. The former ask, "Are we compliant?" The latter ask, "What is our actual exposure?". It's a stark difference. The 21,899 exposed servers are not 21,899 compliance failures, or rather, not only. They are 21,899 dependencies on a legacy infrastructure, exposed to the whole world. The incident is a reminder that with software, we are all tenants. A vulnerability in a third-party library, a previously unknown flaw in a core protocol, or the hostile action of a compromised dependency; the supply chain is only as strong as its weakest link. With Exchange Server, the supply chain is even more tightly coupled. The vendor controls the code and the update channel. The customer controls the deployment. If a bug appears in Exchange, it's the customer who is on the line. The 85% figure is an example of misplaced responsibility. The vendor takes responsibility for their product; the customer takes responsibility for their environment. But the customer is often not equipped for that job. The true sign of a system in denial is a pattern where specific warnings are ignored because of competing priorities. The vulnerability singled out is a warning sign, a direct signal that the era of self-managed, high-value email infrastructure is over. The future of Exchange, indeed, of all complex enterprise on-premises infrastructure, is either in the cloud or behind a managed service provider. The local deployment model is too fragile when an adversary can move from an unpatched server to SYSTEM-level code execution within a matter of hours. The old trust assumption—that your internal network is safe—is dead. It died with every zero-day that bypassed the perimeter, with every VPN that was compromised, and with every server that wasn't patched in time. The intriguing aspect of this vulnerability is not its technical sophistication, but its mundane predictability. We have seen this playbook before: a critical vulnerability in a legacy Microsoft component, followed by disclosure, followed by public PoC, followed by mass exploitation. What changes is the baseline. The 85% unpatched rate represents a standing invitation to malicious actors. A forward-looking approach must acknowledge the migration to cloud managed services is not a panacea, but it is a structural improvement. Cloud providers have a greater incentive to patch quickly, and they can deploy the fixes without waiting for enterprise change control boards. Centralized security is a massive advantage over distributed ignorance. The hard truth is the one we keep avoiding: if you cannot patch quickly, do not run software that requires it. Does the false comfort of a known 21,899 count mask a deeper vulnerability? The Shadowserver count provides a snapshot, a false sense of certainty in an uncertain world. The attackers do not care about Shadowserver's scan scope. They care about the organizations running unpatched servers behind VPNs, the companies with no visibility into their own internet-facing assets, and the IT teams so overwhelmed by the volume of patches that they have to prioritize only the ones with active exploitation. The Signal remains silent in the noise. In this case, the noise is the never-ending stream of CVEs, and the signal is that the model itself is broken. The future is not about this specific patch. It is about understanding that the days of managing complex infrastructure with a small IT team and a hope are over. If you are running an on-premises Exchange Server today, you are running a legacy system that is more likely to be compromised than not. You are a laggard. In a market that is slowly waking up to the operational risks of on-premises infrastructure, the single most effective security control might be your exit strategy from the data center. Can you afford to wait for the next 85% unpatched snapshot, or will you see the writing on the wall before the exploit hits your infrastructure? The next quarter will tell whether enterprises continue to chase patches with 20th-century processes or finally accept the structural reality of 21st-century security. The technology stack will decide. The timeline will decide. The blocks will record it all.