The security update that fixes this vulnerability has been available for several months, but, notably, to this day, attackers find vulnerable servers to target. The first scenario is more common, but we’re seeing a rise in attacks of the second variety specifically, attacks that exploit Exchange vulnerabilities like CVE-2020-0688. This is an attacker’s dream: directly landing on a server and, if the server has misconfigured access levels, gain system privileges. The second scenario is where attackers exploit a remote code execution vulnerability affecting the underlying Internet Information Service (IIS) component of a target Exchange server. The first and more common scenario is attackers launching social engineering or drive-by download attacks targeting endpoints, where they steal credentials and move laterally to other endpoints in a progressive dump-escalate-move method until they gain access to an Exchange server. There are two primary ways in which Exchange servers are compromised.

Attackers know this, and they leverage this knowledge to gain a stable foothold on a target organization. This is exacerbated by the fact that Exchange servers have traditionally lacked antivirus solutions, network protection, the latest security updates, and proper security configuration, often intentionally, due to the misguided notion that these protections interfere with normal Exchange functions. If compromised, Exchange servers provide a unique environment that could allow attackers to perform various tasks using the same built-in tools or scripts that admins use for maintenance. Any threat or vulnerability impacting Exchange servers should be treated with the highest priority because these servers contain critical business data, as well as highly privileged accounts that attackers attempt to compromise to gain admin rights to the server and, consequently, complete control of the network. Securing Exchange servers is one of the most important things defenders can do to limit organizational exposure to attacks.

SSO solution: Secure app access with single sign-on.

Identity & access management Identity & access management.

App & email security App & email security.

Data exchange host windows 10