Learn What IT Pros Need to Know About Windows 11 - August 26th at 1 PM ET! Learn What IT Pros Need to Know About Windows 11 - August 26th at 1 PM ET!
Exchange Server

Microsoft Warns of Active Exchange Server Exploits, Patches Released

If you are running an on-premises version of Microsoft Exchange Server, you need to patch your system immediately. Microsoft has announced that they have detected multiple active 0-day exploits being used against the software.

In the announcement post, Microsoft identifies the vulnerabilities that are being exploited as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 – all of these exposure vectors have been patched with the updates that were released yesturday.

Microsoft notes that the entity using these exploits, HAFNIUM, is targeting entities in the United States across a wide variety of industries including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Based on the company’s detective work, it reads more like if you have an active Exchange server running in your environment, you could likely be a target for attack.

Here are a few more details about the attacks, via Microsoft:

Sponsored Content

Read the Best Personal and Business Tech without Ads

Staying updated on what is happening in the technology sector is important to your career and your personal life but ads can make reading news, distracting. With Thurrott Premium, you can enjoy the best coverage in tech without the annoying ads.

  • CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange that allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.
  • CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.
  • CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.
  • CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

If you think you may be been attacked or want to research if your system has been compromised, Microsoft has provided PowerShell scripts that can identify entries in your log files to understand if you were targeted by HAFNIUM.

I know that many IT Pros do not always patch on the day of a release to make sure there are not any hiccups in the release that could cause additional headaches. But with this release, it is a known active exploit and it is in your best interest to determine quickly if you were targeted and to also patch the exploit.

Related Topics:

BECOME A PETRI MEMBER:

Don't have a login but want to join the conversation? Sign up for a Petri Account

Register
Comments (0)

Leave a Reply

Brad Sams has more than a decade of writing and publishing experience under his belt including helping to establish new and seasoned publications From breaking news about upcoming Microsoft products to telling the story of how a billion dollar brand was birthed in his book, Beneath a Surface, Brad is a well-rounded journalist who has established himself as a trusted name in the industry.

Register for Advanced Microsoft 365 Day!

GET-IT: Advanced Microsoft 365 1-Day Virtual Conference - Live August 24th!

Join us on Tuesday, August 24th and hear from Microsoft MVPs and industry experts about how to take advantage of Microsoft 365 at a technical level and dive deep into the features and functionality that will make your environment more secure and compliant.

RSVP Now

Sponsored By