Around 9700 Microsoft Exchange Servers Affected by Privilege Escalation Vulnerability

The report details CVE-2019-1136, an Exchange Server elevation-of-privilege vulnerability involving EWS and NTLM token handling that could allow mailbox impersonation via a man-in-the-middle attack; it shows how to use Censys X-OWA-Version header searches to identify affected servers and reports roughly 9,700 potentially vulnerable instances, while noting Microsoft updated EWS NTLM handling and no known public exploits existed at publication.