Microsoft Exchange Vulnerability: What Admins Should Do

This document explains how Zscaler Private Access (ZPA) prevents Exchange servers from being exposed to internet-based attacks by brokering short-lived, application-specific connections (managed devices use an encrypted ZPA tunnel; unmanaged devices use Clientless Access). It contrasts ZPA with traditional VPNs and states that when Exchange is placed behind ZPA, CVE-2026-62911 (an authentication bypass requiring access to port 443) is effectively not exploitable from the internet, regardless of patch status.