High Threat Security Alert (A21-03-01): Multiple Vulnerabilities in Microsoft Exchange Server


 

Published on: 03 March 2021

  
  

Description:

Microsoft has released an out-of-band security updates addressing multiple vulnerabilities in Microsoft Exchange Server. A successful exploitation of the four actively exploited vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) requires the ability to make an untrusted connection to Microsoft Exchange Server via port 443.

Reports indicate that active exploitation of the vulnerabilities in Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) have been observed. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

 

Affected Systems:

  • Microsoft Exchange Server 2013, 2016 and 2019

 

Impact:

A successful attack could lead to remote code execution on an affected system.

 

Recommendation:

Patches for affected products are available from the Windows Update / Microsoft Update Catalog. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

 

More Information:

  • https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b
  • https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
  • https://www.hkcert.org/security-bulletin/microsoft-exchange-server-multiple-vulnerabilities_20210303
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26412
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26854
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26855
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26857
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26858
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27065
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27078


Tag: Microsoft , Exchange Server
Tags