The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server.Microsoft has released out-of-band security updates to address four vulnerabilities in Exchange Server: (Updated April 14, 2021): Microsoft's April 2021 Security Update newly discloses and mitigates significant vulnerabilities affecting on-premises Exchange Server 2013, 2016, and 2019. If an organization finds no activity, they should apply available patches immediately and implement the mitigations in this Alert.Ĭlick here for IOCs in STIX format. If an organization discovers exploitation activity, they should assume network identity compromise and follow incident response procedures. To secure against this threat, CISA recommends organizations examine their systems for the TTPs and use the IOCs to detect any malicious activity. This Alert includes both tactics, techniques and procedures (TTPs) and the indicators of compromise (IOCs) associated with this malicious activity. The vulnerabilities impact on-premises Microsoft Exchange Servers and are not known to impact Exchange Online or Microsoft 365 (formerly O365) cloud email services. Microsoft released out-of-band patches to address vulnerabilities in Microsoft Exchange Server. Successful exploitation may additionally enable the attacker to compromise trust and identity in a vulnerable network. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system. Note: This Alert was updated April 13, 2021, to provide further guidance.Ĭybersecurity and Infrastructure Security Agency (CISA) partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. For more information on Chinese malicious cyber activity, refer to /China. Additional information may be found in a statement from the White House. Government attributes this activity to malicious cyber actors affiliated with the People's Republic of China (PRC) Ministry of State Security (MSS).

Exchange server 2013 download