Microsoft confirms that Chinese hackers breached the email accounts of more than two dozen organizations worldwide, including U.S. and Western European government agencies. The attacks were carried out by a threat group tracked as Storm-0558, who used an inactive consumer signing key to create tokens for Azure Active Directory and Microsoft accounts (MSA) to access [...]
The Microsoft July 2023 Patch Tuesday update (released July 11) does not include any changes for Exchange Server security. It does address 132 CVEs, nine of which were labelled as "critical." Most notably, this update also fixes six zero-day vulnerabilities that were actively exploited in the wild, as well as thirty-seven remote code execution (RCE) [...]
Microsoft released security updates for Exchange Server on June 14, 2023. While no active threats are currently known to be exploiting these vulnerabilities, IT admins should prioritize patching them as soon as possible. One of the most critical vulnerabilities is a bypass of fixes for two Exchange Server remote code execution bugs. This vulnerability exists [...]
Microsoft has confirmed that there are massive issues and outages across Exchange, Outlook, Teams, and OneDrive. The company is currently investigating the cause of the outage and has not yet provided an ETA for when it will be resolved. In the meantime, users are experiencing problems with sending and receiving emails, accessing files, and using [...]
The recent disruption to Microsoft 365 services resulted in users being unable to access their apps for the sixth time this year. Users had reported difficulties in accessing their Outlook mailboxes, and connection attempts to Microsoft 365 servers were unsuccessful. The company acknowledged these issues in a notification, stating, "User reports indicate that the disruption [...]
Microsoft has recently announced its intention to make Edge the default browser for opening web links from the Outlook application. According to the article, this update will affect users of Microsoft 365 services, meaning that any links clicked within the Outlook for Windows app will automatically open in Edge. The originating email with the link [...]
Toronto, Canada – May 3rd, 2023: Messageware Incorporated, the leader in Microsoft Exchange security and productivity tools, announced a new version of their flagship product Messageware Exchange Protocol Guard (EPG). The latest version enhances Exchange Server security with official integration of Spamhaus threat intelligence data feeds. These feeds provide highly accurate, real-time data about systems [...]
Microsoft released Cumulative Update 13 for Microsoft Exchange Server 2019 on May 3rd, 2023. This cumulative update is a security update. It includes fixes for nonsecurity issues and all previously released fixes for security and nonsecurity issues , including updates in the March 2023 SU. Highlights: Microsoft has announced that they are bringing Modern Authentication to pure on-premises Exchange Server environments [...]
Microsoft 365 has experienced another outage, which is impacting search features in several services. Microsoft experienced another outage that impacted the search functionality of various Microsoft 365 services, including Outlook on the web, Exchange Online, SharePoint Online, Microsoft Teams, and Outlook desktop clients. The company acknowledged the problem on April 24th and stated that it [...]
The New York Attorney General has accepted a settlement of $200,000 from a New York-based medical malpractice law firm in response to their inadequate data security practices that resulted in more than one-hundred thousand hospital patient's details been exposed. According to Letitia James, the Attorney General of New York, HPMB's "poor data security measures" were [...]
Summary CERT-UA, Ukraine's Computer Emergency Response Team, was the first to discover the vulnerability with a 9.8 CVSS score that affects all supported versions of Outlook for Windows. Microsoft reported that a group of Russian hackers took advantage of the NTLM vulnerability to attack a number of European and military organizations in 2022. The Threat [...]
The March 2023 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes. Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment. Official announcement can be found here. Microsoft has released Security Updates (SUs) for [...]
We’ve seen a wave of cyberattacks and data breaches that swept across the globe with multiple zero-day exploits discovered in Exchange Online and On-premises. Microsoft is urging admins to protect their Exchange Servers by keeping Exchange servers updated with the latest CUs and SUs. “Attackers looking to exploit unpatched Exchange servers are not going to go away.” [...]
Microsoft recently posted that users have a mere 31 days left to migrate away from Exchange Server 2013 before it reaches End-of-life (EOL). The Exchange Team has confirmed that even though support is ending soon, the software will still function past its expiration date. Taking this route is a bit of a risk as Microsoft won't be [...]
Microsoft is looking into another global outage that has impacted Exchange Online, its cloud-based email system. The Microsoft 365 Status Twitter feed reported “impact is specific to users who are served through the affected infrastructure in North America, Europe, and the United Kingdom.” The thread continues, "We're investigating an issue wherein users may be unable [...]
Microsoft has released patches to fix numerous vulnerabilities in the February 2023 Patch Tuesday release including remote code execution in Exchange Server. Official announcement can be found here. Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server 2013 Exchange Server 2016 Exchange Server 2019 To learn more about these vulnerabilities, see the following [...]
“We’ve said it before, we’re saying it now, and we’ll keeping saying it: It is critical to keep your Exchange servers updated.” Microsoft is reminding admins once again not only to stay current on the latest Cumulative Update (CU) and Security Update (SU) on all Exchange servers, but to also perform manual tasks to harden [...]
Exchange Server 2013 will reach its end of support on April 11, 2023. If you haven't already begun your migration from Exchange 2013 to Microsoft 365, Office 365, or Exchange 2019, now's the time to start planning. This means all security updates and patches will be ending soon! After April 11th Microsoft will no longer [...]
Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server 2013 Exchange Server 2016 Exchange Server 2019 The updates address the following vulnerabilities: CVE-2023-21745: Spoofing Vulnerability CVE-2023-21761: Information Disclosure Vulnerability CVE-2023-21762: Spoofing Vulnerability CVE-2023-21763: Elevation of Privilege Vulnerability CVE-2023-21764: Elevation of Privilege Vulnerability Official announcement can be found here. SUs are available for [...]
Threat actors affiliated with the Play ransomware strain are leveraging a never-before-seen exploit method that bypasses Microsoft’s ProxyNotShell URL rewrite mitigation. A New Exploit Chain CrowdStrike researchers have discovered a new exploit method they have named OWASSRF, or Outlook Web Access Server-Side Request Forgery. The novel exploit affects Exchange Server 2013, 2016 and 2019 by leveraging CVE-2022-41080 [...]
