The 21,899-Server Time Bomb: Exchange's MRSProxy Flaw and the Architecture of Neglect

The number is 21,899. That is the count of internet-exposed Exchange Servers as of August 31st, 2026. It is not a statistic. It is a ledger of unpatched liabilities. Germany alone accounts for 5,100 of these instances, with 85% of its local Exchange estate still vulnerable to CVE-2026-62911. The patch has been available for weeks. The PoC has been public for days. The gap between those two facts is where breaches live. This is not a story about a missing update. It is a forensic audit of a product architecture that has been running on borrowed time, and a vendor strategy that is deliberately letting it collapse. CVE-2026-62911 is a pre-authentication remote code execution chain residing in the MRSProxy service. The attack path is brutally efficient: bypass authentication, abuse a WCF method, write an ASPX webshell, execute code as SYSTEM. Orange Tsai demonstrated the full chain. It is weaponized, not theoretical. The root cause is a dual-path architecture inconsistency. The /EWS/MRSProxy.svc endpoint is hosted by IIS and protected by Extended Protection for Authentication (EPA). The alternative path, /Microsoft.Exchange.MailboxReplicationService.ProxyService, is hosted by HTTP.sys and lacks EPA entirely. Two paths. Two security postures. One is a backdoor by design. This is a textbook case of architectural debt. Exchange Server is a codebase with over two decades of iteration. The HTTP.sys path was likely introduced as a performance bypass, a shortcut for high-throughput replication. It was optimized for latency, not for security. The security review did not keep pace with the performance optimization. This is the classic failure mode of a product in maintenance mode: new features are frozen, but the attack surface remains dynamic. The code does not stop evolving; it just stops being defended. My experience auditing consensus layers tells me that this is a governance failure, not a coding error. When I reverse-engineered the Casper FFG spec, I found edge cases in the slashing mechanism because the spec had been written by different teams at different times, with inconsistent assumptions about finality. The same pattern applies here. The IIS path was built by the security-conscious team. The HTTP.sys path was built by the performance team. The two teams did not share a threat model. The result is a protocol-level inconsistency that an attacker can exploit with mathematical certainty. Let me quantify the exposure. Shadowserver data shows 21,899 exposed IPs. That is the visible tip. It excludes internal deployments, VPN-exposed instances, and mail gateways that proxy to backend servers. The real attack surface is likely three to five times larger. The geographic concentration is telling: the US and Germany account for over half of the exposed servers. These are mature markets with deep enterprise IT infrastructure. They are also markets where the installed base of legacy software is highest. The correlation between economic development and legacy deployment is direct. Emerging markets skipped the on-premise phase entirely and went straight to cloud. They are not in this dataset. The developed world is paying the tax for its own infrastructure history. The patch response timeline is the second critical data point. The German BSI reports 85% of local Exchange servers remain unpatched as of September 1st. This is not negligence. It is a structural time lag. Enterprise change management requires 4-8 weeks to validate and deploy a critical patch. The PoC was published immediately after the patch release. The attacker's weaponization speed is measured in days. The defender's deployment speed is measured in weeks. This asymmetry is the core vulnerability. It is not a bug in Exchange. It is a bug in the entire on-premise software model. Here is the contrarian angle that most analysts miss: Microsoft is not failing to secure Exchange. It is succeeding at retiring it. The ESU (Extended Security Update) program for Exchange 2016 ends in October 2026. That is a hard deadline. After that, there is no patch path. The message is unambiguous: migrate to Exchange Online or accept the risk. Microsoft's strategy is to control the security investment in the on-premise product to drive cloud migration. This is not a conspiracy theory. It is a rational business decision. The local product is a cash cow in decline. The cloud product is the future revenue stream. Every vulnerability in the legacy product is a sales pitch for the cloud. The 21,899 exposed servers are not a security incident. They are a marketing campaign. The regulatory response is fragmented. NCSC-NL issued a confirmation. BSI published quantitative data. CISA listed the vulnerability as "none" for known exploitation. These are three different risk assessments for the same vulnerability. The discrepancy reflects differing intelligence capabilities and risk appetites. For enterprises, this creates a compliance nightmare. Under GDPR, a known unpatched vulnerability that leads to a data breach is evidence of failure to implement appropriate technical measures. The fine is not for the breach. It is for the negligence. The paper trail of patch assessment and deployment is now a legal document. The GitHub PoC has 160 stars and 27 forks. That is a low number, but it is a leading indicator. The security research community is faster than the defense community. This is an information asymmetry that cannot be closed. The researcher's incentive is disclosure. The defender's requirement is time. The gap between those two is the attack window. Consensus is not a feature; it is the only truth. In blockchain, finality is binary. A transaction is either confirmed or it is not. In enterprise security, the same logic applies. A server is either patched or it is exploitable. There is no middle state. The 85% unpatched rate in Germany is not a statistic. It is a binary condition for 85% of the market. They are exploitable. The only question is whether an attacker has scanned them yet. The ESU deadline is the real countdown. October 2026 is not a product lifecycle date. It is a security cliff. After that, Exchange 2016 becomes a permanent zero-day repository. The patches stop. The vulnerabilities do not. The internet exposure does not disappear because the vendor declares end-of-life. The servers remain online, running outdated code, processing sensitive corporate email, and waiting for a scan. My recommendation is not to patch. Patching is a stopgap. The recommendation is to treat this as a forced migration event. The on-premise model is structurally broken. The security responsibility is on the customer, but the customer's capability is uneven. The cloud model transfers that responsibility to the vendor. The trade-off is control for security. For most organizations, that is a rational trade. The 21,899 exposed servers are the evidence. The 85% unpatched rate is the verdict. The local deployment model has failed its security test. The market will not wait for the next CVE to make that decision. The migration to cloud is not a preference. It is an inevitability. The only question is whether you migrate on your own timeline or on the attacker's.