Microsoft made updates available for Exchange Server 2010, 2013, 2016 and 2019 last patch period to close some vulnerabilities. One of the vulnerabilities concerns CVE-2020-0688 which the NCSC has designated as High/High. This means that there is a high probability that these vulnerabilities will be exploited and the potential damage could be high.
Exchange is a product of Microsoft that is used as a mail server to receive and send e-mails often with its own domain (@company.co.uk) as the sender. In addition, an Exchange Server gives the ability to synchronize e-mail, contacts and calendars with different devices.
Many companies nowadays use e-mail in the cloud such as Office365 or Gmail, but despite this trend there are still many companies that run their own e-mail server. In many cases, Microsoft Exchange Server is used for this purpose.
By exploiting a vulnerability in the "Exchange Control Panel (ECP)," a remote attacker can (potentially) execute arbitrary code and thereby take over the entire vulnerable Exchange server. This means that the attacker has full control and can, for example, install all kinds of programs, view, edit, delete e-mails but also create new accounts. Also, such an attack could lead to a serious ransomware attack.
If you are using an Exchange Server or are not sure, it is advisable to contact your IT service provider. It is important to check if the available update is already installed, if not we recommend to install it as soon as possible.
On the website of Microsoft you can find all necessary information about this.
Microsoft Exchange Server 2010 will achieve End-Of-Life status at the end of this year (Oct. 20), which means that, among other things, security updates will no longer be available for this version. Consider switching to the latest version of Exchange Server (2019) or another e-mail platform. By the way, do not wait too long with this, an upgrade or migration of an Exchange Server can be a lengthy process depending on its size. So start this early or coordinate this further with your IT service provider.
