Remediation Steps for the Microsoft Exchange Server Vulnerabilities
Summary: On March 2, the security community learned of four critical zero-day Microsoft Exchange Server vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) that let adversaries access Exchange Servers and potentially gain long-term access to victim environments. MSTIC attributes the initial campaign with high confidence to HAFNIUM, a group it assesses as state-sponsored and operating out of China, while Unit 42 estimates over 125,000 unpatched Exchange Servers remain worldwide and that the flaws were actively exploited for at least two months before patches were available.
What's compelling: Patching does not remove malware already deployed or evict actors already in the network, and Unit 42 advises assuming any Exchange Server that exposed Outlook Web Access or Exchange Web Services to the internet is compromised until proven otherwise - with tens of thousands of organizations estimated potentially compromised globally.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Related
- Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·