This week’s major IT security news has been the exploitation of four zero-day vulnerabilities in Microsoft Exchange Server versions 2013, 2016 and 2019. The vulnerability allows attackers to have HTTP requests fraudulently authenticated as Exchange server.
Estimates by end of week were that around 20,000 organizations in the United States had been affected — enough that the White House commented on their concern.
Microsoft has rushed out a patch for the vulnerabilities, which affected organizations should apply. Note that these attacks are targeting on-premise Exchange installations — not cloud-based Outlook accounts.