Stay updated on Exchange Server security with the latest news, updates, and expert insights into protecting your email communications effectively.
Search across headline titles and summaries.
Background for this topic.
Exchange Server is a Microsoft server platform for organizational email, calendars, contacts, and mailbox storage. It may run within an organization or as part of a hybrid environment, and commonly exposes web, mail-transfer, and administration interfaces. Because it stores business communications and can mediate access to accounts, it is a high-value system for security teams.
Security concerns include exploitation of vulnerabilities in internet-facing services, theft or misuse of privileged accounts, and unauthorized mailbox access through weak authentication or compromised credentials. Protection requires prompt, tested security updates; minimizing and monitoring external exposure; strong authentication for administrators and remote access; and careful separation of administrative privileges. Logs from web access, authentication, mailbox activity, and mail flow support detection and investigation. Organizations should also maintain tested backups and recovery procedures, while applying retention, access-control, and privacy requirements to stored messages and attachments.
Weekly headline count for the current query.
Just migrate already, would you? But if you can't, Redmond will take your cash Microsoft will keep delivering security updates for old versions of Exchange Server and Skype for Business Server, after admitting that some customers aren't ready to make the move to newer products.…
Cybersecurity agency urges organizations to upgrade or risk total network compromise Germany's infosec office (BSI) is sounding the alarm after finding that 92 percent of the nation's Exchange boxes are still running out-of-support software, a fortnight after Microsoft axed versions 2016 and 2019.…
No reported in-the-wild exploits…yet Microsoft and the feds late Wednesday sounded the alarm on another high-severity bug in Exchange Server hybrid deployments that could allow attackers to escalate privileges from on-premises Exchange to the cloud.…
It looks like enough of you are struggling to migrate that Redmond is willing to help out – for a price that might buy nothing Microsoft has extended its security update programs for Exchange Server 2016 and 2019, and Skype for Business 2015 and 2019.…
But we mean, you've had nearly four years to patch One of the critical security flaws exploited by China's Salt Typhoon to breach US telecom and government networks has had a patch available for nearly four years - yet despite repeated warnings from law enforcement and private-sector security firms, nearly all public-facing Microsoft Exchange Server instances with this vulnerability remain unpatched.…
One might say this is a wurst case scenario The German Federal Office for Information Security (BIS) has issued an urgent alert about the poor state of Microsoft Exchange Server patching in the country.…
Running unsupported and unpatched versions of Exchange Server will do that to a country Sri Lanka's Computer Emergency Readiness Team (CERT) is currently investigating a ransomware attack on the government's cloud infrastructure that affected around 5,000 email accounts, it revealed on Tuesday.…
Guess this'll have to do while we wait for *checks notes* ES 2025 Microsoft last year said that it was putting off the next version of Exchange Server until the second half of 2025 so engineers could continue bulking up the security of a product that has become a popular target of cybercriminals.…
If you need extra time to dump RPS, OK, but email from unsupported Exchange servers is blocked till they’re up to date Some Exchange Online users who have the RPS feature turned off by Microsoft can now have it re-enabled – at least until September when the tool is retired.…
Software giant takes some files and processes off the exclusion list Microsoft is recommending that Exchange server users scan certain objects for viruses and other threats that until now had been excluded.…
If you want to keep the miscreants out, put the updates in, Redmond says Microsoft is urging organizations to protect their Exchange servers from cyberattacks by keeping them updated and hardened, since online criminals are still going after valuable data in the email system.…
And for bonus points, there's a Windows flaw under active exploit Patch Tuesday Microsoft fixed more than 80 security flaws in its products for October's Patch Tuesday. But let's start off with what Redmond didn't fix: two Exchange Server bugs dubbed ProxyNotShell that have been exploited by snoops as far back as August.…
Remember this next time Microsoft talks about how seriously it takes security Security researchers have warned a zero-day flaw in Microsoft’s Exchange server is being actively exploited.…
Microsoft details this ransomware-as-a-service Two of the more prolific cybercriminal groups, which in the past have deployed such high-profile ransomware families as Conti, Ryuk, REvil and Hive, have started adopting the BlackCat ransomware-as-as-service (RaaS) offering.…
Threat actor exploited known vulnerabilities in the Microsoft software to compromise multiple systems An affiliate of the aggressive Hive ransomware group is exploiting known vulnerabilities in Microsoft Exchange servers to encrypt and exfiltrate data and threaten to publicly disclose the information if the ransom isn't paid.…
Cicada's months-long global espionage campaign marks an expansion of team's capabilities A China-backed crew is said to be running a global espionage campaign against governments, religious groups, and non-governmental organizations (NGOs) by, in some cases, possibly exploiting a vulnerability in Microsoft Exchange servers.…
Windows backdoor shows off some interesting techniques Cyber-criminals are using compromised Microsoft Exchange servers to spam out emails designed to infect people's PCs with IcedID,…
And Adobe, SAP, Intel, AMD, Cisco, Google join in Patch Tuesday Microsoft has addressed 71 security flaws, including three critical remote code execution vulnerabilities, in its monthly Patch Tuesday update. The IT giant is confident none of the bugs have been actively exploited. …