On September 30, 2022, Microsoft released guidance regarding Zero-Day Vulnerability CVE exploits discovered in Microsoft Exchange Server in August of 2022. This guidance appeared in various industry alerts – including the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), where the alert has been provided to assist organizations in guarding against the persistent malicious actions of cybercriminals.
powersolution is a member of the NJCCIC, an organization within the New Jersey Office of Homeland Security and Preparedness, that works to make New Jersey more resilient to cyberattacks. It promotes statewide awareness of cyber threats and widespread adoption of best practices.
Microsoft Exchange Server is a mail and calendaring server developed by Microsoft, which runs exclusively on Windows Server operating systems. There are two zero-day vulnerabilities that have been reported to affect Microsoft Exchange Server 2013, 2016, and 2019.
A zero-day vulnerability is a system or device vulnerability that has been disclosed but is not yet patched. It is a software flaw that cybercriminals can target with malicious code to perform data theft and other network compromises.
Microsoft continues working on a fix. On October 1, 2022 Microsoft added information about the exploit detection related to this threat and retracted the section on MFA as mitigation that was included in the original announcement.
Organizations are encouraged to review Microsoft’s Security Advisory and apply the necessary mitigations until patches are made available. Check for Microsoft patches and install them immediately once they are available.
Please contact powersolution if you would like to discuss the Microsoft Exchange Server vulnerability or other cyber protections and possible methods to mitigate risk for your small business, or if you have any other IT security questions or concerns. Please call (201) 493-1414.
How is your state of IT? Call Us: (855) 551-7760 with any questions.
