The U.S. National Security Agency discovered and notified Microsoft of two Exchange Server vulnerabilities that could allow hackers to persistently access and control enterprise networks.
The latest flaws impact on-premises Microsoft Exchange Servers 2013, 2016, and 2019, and could be exploited by adversaries to gain access and maintain persistence on the target host, according to the Cybersecurity and Infrastructure Security Agency. These flaws are likely to be weaponised, and CISA said there’s high potential they could compromise the integrity and confidentiality of agency information.
“CISA has determined that these vulnerabilities pose an unacceptable risk to the Federal enterprise and require an immediate and emergency action,” the agency wrote in a supplemental directive issued Tuesday. Federal agencies with on-premises Microsoft Exchange servers are required to deploy Microsoft’s patches by 12:01 a.m. USET Friday or remove the servers from agency networks, CISA said.