Exchange Server on the internet: reading exposure when the banner names the protocol, not the build

Microsoft's October 2026 update included several Exchange Server entries, among them CVE-2026-70279, a spoofing vulnerability scored 9.3, and CVE-2026-70571, a stack-based buffer overflow scored 8.1. Both require attention, and both invite the same exposure question: how many Exchange servers answer on the internet, and what does a scan actually learn about them?

ZoomEye queries for this article were not completed because the API returned HTTP 502 during the research window. No asset counts are presented. The query designs below are offered with their interpretation limits stated.

How Exchange appears in scan data

app="Microsoft Exchange" finds assets ZoomEye has fingerprinted as Exchange. title="Outlook Web App" and title="Exchange" find login interfaces. http.header.server="Microsoft-IIS" finds IIS, which hosts Exchange and a great deal else.

These populations nest unevenly.…