Security News > 2022 > August > Microsoft: Exchange ‘Extended Protection’ needed to fully patch new bugs
Microsoft says that some of the Exchange Server flaws addressed as part of the August 2022 Patch Tuesday also require admins to manually enable Extended Protection on affected servers to fully block attacks.
Remote attackers can exploit these Exchange bugs to escalate privileges in low-complexity attacks after tricking targets into visiting a malicious server using phishing emails or chat messages.
Microsoft says that admins also need to enable Extended Protection after applying today's security updates to make sure that threat actors won't be able to breach vulnerable servers.
"Customers vulnerable to this issue would need to enable Extended Protection in order to prevent this attack," Redmond said in advisories published Tuesday.
A script provided by Microsoft is available to enable this feature, but admins are advised to "Carefully" evaluate their environments and review the issues mentioned in the script documentation before toggling it on their Exchange servers.
Since Redmond has also tagged all three Exchange vulnerabilities as "Exploitation More Likely," admins should patch these flaws as soon as possible.
News URL
Related news
- What Is Patch Tuesday? Microsoft’s Monthly Update Explained (source)
- Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws (source)
- Microsoft: Exchange 2016 and 2019 reach end of support in October (source)
- Microsoft: Outdated Exchange servers fail to auto-mitigate security bugs (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- February's Patch Tuesday sees Microsoft offer just 63 fixes (source)
- Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)