Microsoft: Update On-Premises Exchange Server Now

Microsoft has urged administrators of on-premises Trade servers to continue to keep them patched and up to date, warning that attackers “are not heading to go absent.”

The tech giant’s Trade Workforce advised in a site write-up yesterday that consumers set up the newest readily available Cumulative Update (CU) and Security Update (SU) on all servers, and in some instances Exchange Management Tools workstations.

CUs are built to streamline the patching procedure by bundling many fixes into a one update. SUs are set up on major of these.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Both equally are cumulative, so organizations only need to have to put in the most current types.

“You put in the latest CU, then see if any SUs ended up released just after the CU was unveiled. If so, put in the most modern (most up-to-date) SU,” Microsoft spelled out.

At the time of writing, the most modern variations are CU12 for Exchange Server 2019, CU23 for Exchange Server 2016 and CU23 for Trade Server 2013, and the hottest SU is the January 2023 SU.

“Attackers on the lookout to exploit unpatched Exchange servers are not likely to go away. There are way too lots of aspects of unpatched on-premises Trade environments that are valuable to poor actors hunting to exfiltrate data or commit other destructive functions,” Microsoft warned.

“First, person mailboxes normally consist of critical and delicate info. Second, each and every Trade server consists of a copy of the business handle e book, which offers a great deal of data that is useful for social engineering attacks, together with organizational framework, titles, make contact with info and a lot more. And third, Exchange has deep hooks into and permissions within just Lively Listing, and in a hybrid environment, entry to the linked cloud natural environment.”

Menace actors have exploited on-premises Trade Server deployments many situations in new yrs, most notably in the ProxyLogon attacks of March 2021 and the targeting of ProxyNotShell bugs that ended up patched November 2022.

Microsoft urged process directors to usually run HealthChecker immediately after setting up an update to verify if there are any more handbook tasks to accomplish.

Editorial credit history icon picture: monticello / Shutterstock.com