Security News > 2023 > November > New Microsoft Exchange zero-days allow RCE, data theft attacks
2023-11-03 15:14
Microsoft Exchange is impacted by four zero-day vulnerabilities that attackers can exploit remotely to execute arbitrary code or disclose sensitive information on affected installations.
ZDI-23-1578 - A remote code execution flaw in the 'ChainedSerializationBinder' class, where user data isn't adequately validated, allowing attackers to deserialize untrusted data.
Attackers can exploit it to access sensitive information from Exchange servers.
Millions of Exim mail servers exposed to zero-day RCE attacks.
3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online.
HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks.
News URL
Related news
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Microsoft fixes Power Pages zero-day bug exploited in attacks (source)
- CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks (source)
- Microsoft Identifies 3,000 Leaked ASP.NET Keys Enabling Code Injection Attacks (source)
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- Apple fixes zero-day exploited in 'extremely sophisticated' attacks (source)
- Apple fixes zero-day flaw exploited in “extremely sophisticated” attack (CVE-2025-24200) (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391) (source)
- Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries (source)