Microsoft Urges Exchange November Security Update
by Michael Bianchi
Senior Solutions Architect
Microsoft announced an Exchange exploit today that requires immediate attention and remediation. CVE-2021-42321 is a post-authentication vulnerability that affects Exchange 2013, 2016 and 2019. This exploit is capable of opening remote shells and delivering malicious payloads, including crypto attacks. Helient and Microsoft both recommend getting to the minimum patch level as soon as possible.
Below is a table of the minimum needed in order to be protected from this vulnerability:
| Version CU (Cumulative Update) | SU (Security Update) |
|---|---|
| Exchange 2013 CU23 | Nov21SU |
| Exchange 2016 CU21 (or 22)* | Nov21SU |
| Exchange 2019 CU10 (or 11) | Nov21SU |
*Helient does not recommend upgrading to CU22 currently due to age of release.
For more information, please see this subject on the MS Exchange Team Blog: https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169.
If you would like more information or assistance from our industry leading team of Messaging experts to plan and execute the upgrade, please contact us at service@helient.com.