A critical flaw in 350,000 Microsoft Exchange remains unpatched

A patch has been available for months, but its adoption has been slow

Over 350,000 of all Microsoft Exchange servers have not been patched against the CVE-2020-0688 post-auth remote code execution vulnerability impacting all supported Microsoft Exchange Server versions.

A patch arrived in Microsoft's February 11 patch, but few organizations have actually moved forward with applying it to their servers.

Microsoft has encouraged admins to apply the patch as soon possible, tagging it with an "Exploitation More Likely" exploitability index assessment, hinting that the vulnerability may be an attractive target for attackers. The company also said that it anticipates future attacks on the remote code execution vulnerability, making the recently released patch even more important.

Attacks on vulnerable Exchange mail servers began in February. These attacks followed the release of a technical report that detailed how the bug worked. This report was then followed by multiple proof-of-concept exploits, along with a Metasploit module. 

Now, nearly two months later, Rapid7 researchers used its Project Sonar to scan the internet and identified at least 82.5% of the 433,464 Exchange servers in the scan were vulnerable to CVE-2020-0688.

To make matters worse, many of the servers tagged by Rapid7 as being safe against attacks may also be vulnerable because many updates to the server did not include an update to the build numbers.

"There are two important efforts that Exchange Administrators and infosec teams need to undertake: verifying deployment of the update and checking for signs of compromise," Rapid7 Labs senior manager Tom Sellers explained.

Related Resource

Five essentials of a secure modern workplace

The CIO's guide to unleashing productivity whilst minimising risk

Download now

Compromised user accounts and accounts that have been used in attacks against Exchange servers can be discovered by checking Windows Event and IIS logs for portions of encoded payloads, including either the "Invalid viewstate" text or the __VIEWSTATE and __VIEWSTATEGENERATOR string for requests to a path under /ecp.

Microsoft says that because there are no mitigating factors for this vulnerability, patching your servers before attackers locate them and compromise your entire network is of the utmost importance.

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Cryptocurrency: Should you invest?

Cryptocurrency: Should you invest?

27 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021