
Exchange Server Vulnerabilities
Urgent NCSC notice: protect your Exchange Servers
You may already know about the four zero-day vulnerabilities in Microsoft Exchange Servers. They’ve been in and out of the news since early January.
What we’re now learning is that a state-sponsored threat group from China is actively exploiting the vulnerabilities, and other cyber attackers have adopted them in widespread attacks. It’s reported that hackers are exploiting them to drop ransomware.
The UK’s National Cyber Security Centre (NCSC) believes that over 3,000 Microsoft Exchange email servers used by UK organisations haven't had the critical security patches applied and therefore remain at risk from cyber attackers who want to take advantage of the vulnerabilities.
Apparently, tens of thousands of organisations around the world have had their email servers compromised by the cyber attacks targeting Microsoft Exchange, potentially putting large amounts of sensitive information into the hands of hackers.
Are your servers affected?
The affected Exchange Server versions are:
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
If you use any of these in your business, the UK’s National Cyber Security Centre (NCSC) advises that you take action immediately to install the latest updates.
What to do
To identify whether your Exchange Server has been compromised with security scripts, check here: GitHub
If your organisation runs an out-of-support version of Exchange Server, NCSC recommends updating to a supported version without delay. It also advises you to report any suspected compromises on its website.
Read more:
- The NCSC’s full news report on Exchange Server vulnerabilities
- Microsoft Exchange Server zero-day attacks: Malicious software found on 2,300 machines in the UK
- White House warns organizations have 'hours, not days' to fix vulnerabilities as Microsoft Exchange attacks increase
- At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software
- Microsoft releases one-click mitigation tool for Exchange Server hacks
Read
More

The Essential Guide to Email Retention Policy
Email is now fast becoming the go-to for businesses in their bid to expand audiences and their…

Australia Privacy Act 1988 reforms & GDPR
The Australian Government is reviewing the Privacy Act 1988. The proposed reforms could affect…

How Email Archiving Changed the Way We Communicate
The digital age has fundamentally changed the way we communicate and interact with others at work…

GDPR: One Year On
On May 25th 2018, the EU rolled out a new set of data privacy laws under the General Data…

The State of Email Security in 2020
2019 sees the end of the latest decade with 2020 ushering in a new one. These last ten years have…
