Zero-day vulnerabilities affecting self-hosted versions of Microsoft Exchange have been identified and are being actively exploited by attackers. Users of the Microsoft 365 application Exchange Online are not affected by these vulnerabilities.
For users with self-hosted deployments of Microsoft Exchange:
- Apply the available patches and monitor for any evidence of compromise.
- The attack methods may not be as targeted as they were originally thought to be, so there is a potential for widescale fallout.
- All customers with self-hosted Exchange servers or hybrid deployments should immediately review and implement advised precautions and remediation.
Due to the use of Microsoft 365 Exchange Online by rocketwise, our customers are not exposed to these vulnerabilities and no action is required by them.
Many machinery company email vendors utilize a version of Exchange that is impacted by these vulnerabilities. If your email is hosted by a vendor using the self-hosted version of Microsoft Exchange, you are encouraged to reach out to them for assurance that their systems have been patched with the latest updates.
