Trusted by more than 2500 companies with over 5 million users

Microsoft Exchange – Messageware Q1 2023 Newsletter

We’ve seen a wave of cyberattacks and data breaches that swept across the globe with multiple zero-day exploits discovered in Exchange Online and On-premises. Microsoft is urging admins to protect their Exchange Servers by keeping Exchange servers updated with the latest CUs and SUs. “Attackers looking to exploit unpatched Exchange servers are not going to go away.” [...]

Microsoft Exchange – Messageware Q1 2023 Newsletter2023-03-28T07:26:36-04:00

Microsoft issues one month EOL warning for Exchange Server 2013

Microsoft recently posted that users have a mere 31 days left to migrate away from Exchange Server 2013 before it reaches End-of-life (EOL). The Exchange Team has confirmed that even though support is ending soon, the software will still function past its expiration date. Taking this route is a bit of a risk as Microsoft won't be [...]

Microsoft issues one month EOL warning for Exchange Server 20132023-03-14T07:18:00-04:00

Microsoft February 2023 Patch Tuesday: Exchange Server Security Updates

Microsoft has released patches to fix numerous vulnerabilities in the February 2023 Patch Tuesday release including remote code execution in Exchange Server. Official announcement can be found here. Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server 2013 Exchange Server 2016 Exchange Server 2019 To learn more about these vulnerabilities, see the following [...]

Microsoft February 2023 Patch Tuesday: Exchange Server Security Updates2023-02-16T05:22:29-05:00

Microsoft Exchange Server 2013 Nears End of Support

Exchange Server 2013 will reach its end of support on April 11, 2023. If you haven't already begun your migration from Exchange 2013 to Microsoft 365, Office 365, or Exchange 2019, now's the time to start planning. This means all security updates and patches will be ending soon!  After April 11th Microsoft will no longer [...]

Microsoft Exchange Server 2013 Nears End of Support2023-01-17T04:12:49-05:00

Microsoft January 2023 Patch Tuesday: Exchange Server Security Updates

Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server 2013 Exchange Server 2016 Exchange Server 2019 The updates address the following vulnerabilities: CVE-2023-21745: Spoofing Vulnerability CVE-2023-21761: Information Disclosure Vulnerability CVE-2023-21762: Spoofing Vulnerability CVE-2023-21763: Elevation of Privilege Vulnerability CVE-2023-21764: Elevation of Privilege Vulnerability Official announcement can be found here. SUs are available for [...]

Microsoft January 2023 Patch Tuesday: Exchange Server Security Updates2023-01-13T10:27:53-05:00

Ransomware Group Targets Microsoft Exchange Server with New Exploit OWASSRF

Threat actors affiliated with the Play ransomware strain are leveraging a never-before-seen exploit method that bypasses Microsoft’s ProxyNotShell URL rewrite mitigation. A New Exploit Chain CrowdStrike researchers have discovered a new exploit method they have named OWASSRF, or Outlook Web Access Server-Side Request Forgery. The novel exploit affects Exchange Server 2013, 2016 and 2019 by leveraging CVE-2022-41080 [...]

Ransomware Group Targets Microsoft Exchange Server with New Exploit OWASSRF2022-12-27T07:28:49-05:00

Microsoft Exchange ProxyNotShell Vulnerability Explained and How to Mitigate It

ProxyShell and ProxyLogon are two high severity exploits against Microsoft Exchange Servers discovered in 2021. Both vulnerabilities enable threat actors to perform remote code execution on vulnerable systems. A year later, another easily exploitable vulnerability named ProxyNotShell is threatening unpatched Exchange Servers. Here's a great article we recommend you read: Microsoft Exchange ProxyNotShell vulnerability explained [...]

Microsoft Exchange ProxyNotShell Vulnerability Explained and How to Mitigate It2022-12-19T07:41:19-05:00

ProxyNotShell Proof-of-Concept Published Online

Security researchers confirm Proof-of-Concept (PoC) works against unpatched versions of Microsoft Exchange Server 2013, 2016 and 2019 In early August, researchers discovered cyberattacks against critical infrastructure using two unpublished Exchange Server security vulnerabilities. Microsoft’s Security Research Center (MSRC) stated: “The first exploit identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows [...]

ProxyNotShell Proof-of-Concept Published Online2022-12-16T10:05:26-05:00

Microsoft November 2022 Patch Tuesday: Exchange Server Security Updates

Microsoft has released security updates for two zero-day vulnerabilities: CVE-2022-41040, a server-side request forgery vulnerability, and CVE-2022-41082, which allows remote code execution. Collectively known as ProxyNotShell, the Exchange Server vulnerabilities have led to a spate of attacks linked to nation-state threat actors since late September. The SUs address vulnerabilities responsibly reported to Microsoft by security [...]

Microsoft November 2022 Patch Tuesday: Exchange Server Security Updates2022-11-11T05:53:35-05:00

On-Premise Chosen over Microsoft 365 due to Server Privacy Concerns

In an ongoing battle that started in 2018 with the EU, several state courts, including the federal German court, found that Microsoft 365 was not compliant with GDPR laws. The ban mostly affects educational institutions and companies that use Microsoft’s 365 product line. The ban comes after Microsoft ended its special arrangements with German users. An [...]

On-Premise Chosen over Microsoft 365 due to Server Privacy Concerns2023-09-13T11:04:20-04:00

Microsoft October 2022 Patch Tuesday: Exchange Server Security Updates

The SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes. Our recommendation is to immediately install these updates to protect your environment. NOTE   The October 2022 SUs do not contain fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082). Please see this blog post to apply mitigations for those [...]

Microsoft October 2022 Patch Tuesday: Exchange Server Security Updates2023-11-17T10:54:00-05:00

Alert: New Zero-Day Vulnerability Targets Microsoft On-Premise and Hybrid Cloud Exchange Servers

Summary: In early August, researchers from the cybersecurity vendor GTSC discovered cyberattacks against critical infrastructure using two unpublished Exchange Server security vulnerabilities. Microsoft’s Security Research Center (MSRC) stated: “The first exploit identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows Remote Code Execution (RCE) when PowerShell [...]

Alert: New Zero-Day Vulnerability Targets Microsoft On-Premise and Hybrid Cloud Exchange Servers2022-12-16T10:12:07-05:00

CISA Publishes Mitigation Techniques Against Exchange Server Attacks

In response to the recent targeting of critical infrastructure in the US and abroad, the Cybersecurity and Infrastructure Security Agency (CISA) urges network and security administrators to prepare and immediately mitigate potential cyber threats with the following measures. Implement and apply backup and recovery policies and procedures: Maintain offline backups of data Regularly test backup and restoration Ensure [...]

CISA Publishes Mitigation Techniques Against Exchange Server Attacks2023-09-13T10:31:00-04:00

Nemesis Kitten targets Exchange Server for Attacks

Microsoft Security Threat Intelligence has been tracking multiple ransomware campaigns by a group known as DEV-0270 who also goes by the alias Nemesis Kitten. Who is DEV-0270? DEV-0270, a sub-group of the Iranian threat actor known as PHOSPHORUS, are known for leveraging newly disclosed vulnerabilities against their targets. If successful, the group contacts the victim [...]

Nemesis Kitten targets Exchange Server for Attacks2022-12-27T07:20:19-05:00

Microsoft Exchange Server Security: The 10 Best Ways to Secure Your Server

Security breaches cause organizational chaos, financial and reputation risk. Given how organizations have shifted to a hybrid of in-office and work-from-home, there is a significant increase in the security threat landscape, and it’s more important than ever to improve and harden Exchange Server security. These best practices help provide a baseline security framework that all [...]

Microsoft Exchange Server Security: The 10 Best Ways to Secure Your Server2024-05-03T10:50:47-04:00

Microsoft Exchange Updates for 2013 and 2010

The Exchange team announced the availability of the most recent quarterly servicing update to Exchange Server 2013. Cumulative Update 10 includes fixes for customer reported issues, minor product enhancements and previously released security bulletins. A complete list of issues resolved in Exchange Server 2013 Cumulative Update 10 can be found in Knowledge Base Article KB3078678. [...]

Microsoft Exchange Updates for 2013 and 20102022-06-06T07:56:29-04:00

Top 3 Security Concerns for Exchange 2013 Cited at Tradeshows this Year

The top three concerns that the organizations we spoke with are facing today with their mobile mail deployments were data breaches, OWA authentication security, and BYOD mail.

Top 3 Security Concerns for Exchange 2013 Cited at Tradeshows this Year2019-01-15T10:21:30-05:00

Exchange 2013 Deployment is now possible with Cumulative Update 1

“Cumulative Update 1 for Exchange Server 2013 resolves issues that were found in Exchange server 2013 since the software was released. This update rollup is highly recommended for all Exchange Server 2013 customers.  Note: the CU1 package can be used to perform a new installation, or to update an existing Exchange Server 2013 installation to [...]

Exchange 2013 Deployment is now possible with Cumulative Update 12019-01-15T10:21:32-05:00