22,000 Microsoft Exchange Servers Exposed to Mailbox Takeover Threat

Microsoft Exchange Server users are at risk of mailbox takeover due to an unpatched vulnerability. The Shadowserver Foundation, a non-profit organization that performs internet-wide security scans, has identified nearly 22,000 public IPs with vulnerable Microsoft Exchange instances. Most of these instances are located in the US and Germany.

The proof-of-concept code for the exploit has been published online, increasing the risk of attack. This allows attackers to take over mailboxes, read or send emails, download attachments, and move deeper into networks. The vulnerability affects Microsoft Exchange Server 2016 and 2019, which have reached the end of support.

Microsoft initially disclosed the bug on August 11th, warning that attackers can reuse captured credentials. The NCSC urges administrators to install updates as soon as possible or limit server access to internal networks. If supported servers are not replaced, they may be targeted by attackers.