Microsoft Exchange 0-day Vulnerability Analysis

In March 2021 Microsoft released patches for critical Microsoft Exchange vulnerabilities (including CVE-2021-26855 and CVE-2021-27065) that were actively exploited in the wild since early January; attackers used SSRF to access mailboxes, chained to RCE to deploy web shells, exfiltrate email data, move laterally, and potentially install further malware or ransomware. Censys observed over 251,000 Exchange servers online with more than half running affected CU versions across many countries and industries; the report urges immediate use of Microsoft detection scripts and application of security updates.