One of Salt Typhoon's favorite flaws still wide open on 91% of at-risk Exchange Servers

Tenable and industry reporting show that China-linked groups (Salt Typhoon and others) continue to exploit unpatched Microsoft Exchange servers (notably CVE-2021-26855/ProxyLogon) and other flaws to gain persistent access to US telecom, government, and critical infrastructure networks using custom malware (GhostSpider, SnappyBee, Masol, Demodex); despite patches being available for years, a large majority of public-facing vulnerable Exchange instances remain unpatched, enabling ongoing campaigns and significant national-security risk.