Microsoft Exchange Server Updates Resolve 0-Day Vulnerabilities

[engine]

Microsoft is urging users of Microsoft Exchange Server 2013, 2016, and 2019 to update after zero-day vulnerabilities were fixed.

We recommend prioritizing installing updates on Exchange Servers that are externally facing. All affected Exchange Servers should ultimately be updated.

[msrc-blog.microsoft.com...]

[engine]

It seems that the European Banking Authority's email servers have been compromised by a cyber-attack, and it makes you wonder how many others are out there.
[bbc.co.uk...]

[engine]

When you look at the timeline on this vulnerability, it doesn't look good. The reports go back to January 2021, but the actual flaw existed since 2010.
[proxylogon.com...]

Krebs has an interesting timeline.
[krebsonsecurity.com...]

[engine]

I find it surprising that even today users have unpatched systems.

According to reports, only about half of the Exchange servers online have applied the patch supplied by Microsoft. :O

Even if organisations have already applied the relevant security updates, there's no guarantee they were not compromised by malicious hackers before the patches were applied – so it's important to analyse the network to examine if it has already been accessed by cyber criminals.

[zdnet.com...]

[lammert]

The Microsoft Exchange servers I see at clients premises are mainly managed by wannabee system administrators like the head of accounting or the son of the owner. They have no in-depth knowledge of security. It's part of the eco-system that Microsoft has created where everyone can run a Windows based network environment with just some fancy GUI tools.