Many Microsoft Exchange Servers Still Vulnerable After Patches Released

Summary

Researchers at Rapid 7 discovered that very few organizations have applied Microsoft’s February 11, 2020 security updates for vulnerable Exchange mail servers. The vulnerability could allow threat actors to compromise the entire Exchange environment and potentially all of Active Directory, depending on server implementation. The patch needs to be installed on any server with Exchange Control Panel (ECP) enabled, which typically has a Client Access Server (CAS) role allowing Outlook Web App (OWA) access.

Recommendations

The NJCCIC recommends administrators patch systems as soon as possible after appropriate testing and inspect systems for signs of compromise. Technical details can be found in the Rapid 7 blog post.