Security News > 2024 > March > Germany warns of 17K vulnerable Microsoft Exchange servers exposed online

Germany warns of 17K vulnerable Microsoft Exchange servers exposed online
2024-03-26 19:21

The German national cybersecurity authority warned on Tuesday that it found at least 17,000 Microsoft Exchange servers in Germany exposed online and vulnerable to one or more critical security vulnerabilities.

According to the German Federal Office for Information Security, around 45,000 Microsoft Exchange servers in Germany have Outlook Web Access enabled and are accessible from the Internet.

For the Exchange 2016 or 2019 servers exposed online, roughly 28% have not been patched for at least four months and are vulnerable to at least one critical security flaw exploitable in remote code execution attacks.

"As early as 2021, the BSI warned several times against the active exploitation of critical vulnerabilities in Microsoft Exchange and temporarily called the IT threat situation 'red.' Nevertheless, the situation has not improved since then, as many Exchange server operators continue to act very carelessly and do not release available security updates in a timely manner."

The BSI urged the admins of these unpatched servers to always use current Exchange versions, install all available security updates, and configure instances exposed online securely.

In February, threat monitoring service Shadowserver warned that 28,500 Microsoft Exchange servers were vulnerable to ongoing CVE-2024-21410 attacks.


News URL

https://www.bleepingcomputer.com/news/security/germany-warns-of-17k-vulnerable-microsoft-exchange-servers-exposed-online/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2024-02-13 CVE-2024-21410 Unspecified vulnerability in Microsoft Exchange Server 2016/2019
Microsoft Exchange Server Elevation of Privilege Vulnerability
network
low complexity
microsoft
critical
9.8

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Microsoft 714 869 4793 4397 3718 13777