Microsoft Exchange Updates April 2021
Microsoft addressed four critical vulnerabilities in Microsoft Exchange Server as part of the April 2021 patch Tuesday release.
CVE-2021-28480 Remote Code Execution 9.8/10.0
CVE-2021-28481 Remote Code Execution 9.8/10.0
CVE-2021-28482 Remote Code Execution 8.8/10.0
CVE-2021-28483 Remote Code Execution 9.0/10.0
There is no known exploitation at the time of notification, however the risk of attack and subsequent compromise steadily increases over time as attackers learn how to exploit any unpatched servers.
Patches are available for the following affected versions:
| Exchange Server 2013 CU23 | KB5001779 |
| Exchange Server 2016 CU19 and CU20 | KB5001779 |
| Exchange Server 2019 CU8 and CU9 | KB5001779 |
Exchange Online customers are already protected.
Microsoft have stated, “Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment.”
Published on April 13 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) stated, “An attacker could use these vulnerabilities to gain access and maintain persistence on the target host. These vulnerabilities are different from the ones disclosed and fixed in March 2021”.
Please see Microsoft Knowledge Base article for update guidance: KB5001779
Daisy’s Operations teams are currently planning expedited customer patching to address these vulnerabilities.
Our dedicated cyber security team are continuing to assess the situation as it evolves to ensure we continue to maintain a secure environment for all of our customers.
Please see the articles below for further information:
https://www.ncsc.gov.uk/news/security-updates-released-microsoft-exchange-server