Critical Security Gaps in Thousands MS Exchange Servers

The German Federal Office for Information Security (BSI) has cautioned about unpatched vulnerabilities in Exchange, affecting many servers. In Germany, about 45,000 Microsoft Exchange servers with Outlook Web Access are publicly available. Around 25% of all German Exchange servers, are vulnerable. The recent discovery of a critical flaw (CVE-2024-21410), base score [CVSS 9+], can be mitigated by enabling Extended Protection for Authentication.