Microsoft's October 2026 update included several Exchange Server entries, among them CVE-2026-70279, a spoofing vulnerability scored 9.3, and CVE-2026-70571, a stack-based buffer overflow scored 8.1. Both require attention, and both invite the same exposure question: how many Exchange servers answer on the internet, and what does a scan actually learn about them?
ZoomEye queries for this article were not completed because the API returned HTTP 502 during the research window. No asset counts are presented. The query designs below are offered with their interpretation limits stated.
How Exchange appears in scan data
app="Microsoft Exchange" finds assets ZoomEye has fingerprinted as Exchange. title="Outlook Web App" and title="Exchange" find login interfaces. http.header.server="Microsoft-IIS" finds IIS, which hosts Exchange and a great deal else.
These populations nest unevenly. An Exchange server with a customised sign-in page may fail title matching while succeeding on fingerprint. A server exposing only ActiveSync or only the Autodiscover endpoint may present neither title nor a fingerprint the engine recognises.
The practical conclusion is that the largest number obtainable from these queries is a lower bound on internet-visible Exchange interfaces, and the smallest number is a subset defined by a specific interface. Neither describes the installed build.
Why the build matters more than the count
CVE-2026-70571 is a stack-based buffer overflow reachable by sending a crafted request over the network, and Microsoft rates it 8.1. CVE-2026-70279 is a cross-site scripting spoofing issue at 9.3 that requires user interaction. Both are fixed in the October 2026 update, and the difference between a patched and unpatched server is entirely a matter of cumulative update and security update level.
Scan data does not reliably report that level. Exchange has historically suppressed or genericised version banners for good reason, and an organisation that has hardened its deployment will have removed the information rather than advertising it.
What the scan can do is identify the population that should be asked. For a defender, that means answering a different question: of the Exchange servers we operate, which are reachable from the internet at all, and of those, which have received the October update?
Queries that separate the roles
app="Microsoft Exchange"
title="Outlook Web App"
title="Exchange" && port=443
http.header.server="Microsoft-IIS" && ssl="exchange"
The certificate-based query is the most interesting of the four. Organisations that issue certificates naming the service expose the role in the certificate subject without exposing the build. A certificate with a subject containing exchange, owa, autodiscover or mail identifies an interface that is very likely mail-facing, and that list is more actionable than a raw product count because each name maps to a URL that administrators recognise.
What defenders should do with the output
Match the internet-visible list against the internal Exchange inventory. Every externally visible interface that does not appear in the internal inventory is a finding, regardless of patch level, because it means the organisation does not know the asset exists.
Then check the reverse: internal Exchange servers that are supposed to be reachable and do not appear. These are usually behind a reverse proxy or a load balancer that terminates the connection, which is fine, and occasionally indicates a DNS or certificate problem worth understanding before the next outage reveals it.
Both directions of the comparison are more valuable than the count itself.
Limits to state plainly
Internet-wide counts of Exchange interfaces describe visibility, not vulnerability. They vary with scan timing, with certificate rotation, and with whether administrators customise login pages.
CVE-2026-70279 requires user interaction, which changes the exploitation calculus without changing the patch requirement. Reporting it as equivalent to an unauthenticated remote code execution flaw would misrepresent the advisory.
The Exchange attack surface has been the subject of sustained exploitation campaigns for years. Any assessment that treats the October updates as the first time this mattered is missing the context that makes these servers a standing priority rather than a monthly one.
References
Microsoft Security Update Guide, October 2026 release notes, for CVE-2026-70279 and CVE-2026-70571
Microsoft MSRC vulnerability pages for the individual CVEs
ZoomEye official MCP search syntax reference for
app,title,http.header.server,sslandport