Microsoft releases urgent security updates for Exchange Server to fix critical vulnerabilities
If you are using Microsoft Exchange Server, you should now install the emergency security update released by Microsoft to fix serious security vulnerabilities.
According to the Microsoft Security Bulletin, the CVE-2021-26858 and CVE-2021-27065 zero-day vulnerabilities in the Exchange Server have been exploited by hackers.
The CVSS score of these vulnerabilities is as high as 9.1, which is why Microsoft immediately released emergency security updates to fix them, and the exploitation of the vulnerabilities is very simple.
Attackers can execute arbitrary commands or even take over the entire server through server-side request forgery flaws, and then they can use permissions for long-term tracking.
“File:Microsoft Exchange (2019-present).svg” by Microsoft Office team is licensed under CC BY-SA 4.0
If the enterprise is using the Microsoft Exchange Server hosting system, there is no need to worry, as Microsoft has actively dealt with it and there is no harm.
However, if the enterprise is using a local server, it needs to install the update by itself to prevent attackers from directly taking over the entire server through request forgery flaws.
The security company that discovered the vulnerability said that the attacker only needs to use the vulnerability to execute the command, and the command is still executed under the system account, so the authority is also very high.
In addition to CVE-2021-26858 and CVE-202127065, there is also a CVE-2021-26857 vulnerability. The first two vulnerabilities can be used to write arbitrary files to the server.
The CVE-2021-26857 vulnerability can be used for execution, so it is very easy for an attacker to use these vulnerabilities to take down the company’s local mail server.
Microsoft recommends that all companies using this mail system install the update immediately to avoid being hacked. If you have any questions, you can contact Microsoft technical support for necessary help.
