Loading story…
CISA, in collaboration with the NSA and international partners, has released new security best practices for on-premises Microsoft Exchange servers, emphasizing the urgent need for organizations to harden authentication, enforce strong network encryption, and minimize attack surfaces. The guidance specifically warns against retaining end-of-life Exchange servers in hybrid environments, as these systems remain highly vulnerable to exploitation by malicious actors. Organizations are strongly advised to decommission unsupported Exchange servers after migrating to Microsoft 365 to reduce exposure to ongoing cyber threats.
In Germany, the Federal Office for Information Security (BSI) reported that 92% of public-facing Exchange servers are still running out-of-support software, just weeks after Microsoft ended support for Exchange 2016 and 2019. This widespread use of unsupported versions affects thousands of companies and public sector organizations, including hospitals, schools, and local authorities. The BSI highlighted that if new critical vulnerabilities are discovered, Microsoft will not provide patches, potentially forcing organizations to take servers offline and risking severe operational disruptions, data leaks, and ransomware attacks due to inadequate network segmentation and hardening.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CISA and NSA, joined by the Australian Cyber Security Centre and the Canadian Centre for Cyber Security, released new best-practices guidance for securing on-premises and hybrid Microsoft Exchange servers. The guidance focused on reducing attack surface, strengthening authentication and admin controls, enforcing encryption, keeping systems updated, and decommissioning end-of-life Exchange servers after migration to Microsoft 365.
Germany's Federal Office for Information Security (BSI) warned that 92% of the country's public-facing Microsoft Exchange servers—about 33,000 systems—were running unsupported software. The agency said the exposure affected critical sectors including hospitals, schools, and government bodies, and urged upgrades, tighter access controls, and network segmentation.
Microsoft ended support for Exchange Server 2016 and 2019 on October 14, leaving those on-premises versions without standard support. The reporting notes Microsoft offered a limited six-month Extended Update Program, after which no further security updates would be available.
Shortly after CISA's emergency directive, Shadowserver reported that more than 29,000 Microsoft Exchange servers remained vulnerable. The finding underscored the scale of internet-exposed risk despite urgent federal mitigation requirements.
CISA issued Emergency Directive 25-02 in August 2025 requiring Federal Civilian Executive Branch agencies to mitigate CVE-2025-53786 within four days. The directive was driven by concerns that exploitation of on-premises Exchange could enable lateral movement into Microsoft cloud environments and potentially total domain compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecisa.gov
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcecyberscoop.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the NSA and international partners from Australia and Canada, released comprehensive best practices to secure on-premises Microsoft Exchange Servers. This guidance addresses the persistent threat posed by attackers exploiting vulnerabilities in Exchange, especially as some versions reach end-of-life and no longer receive security updates. Key recommendations include restricting administrative access, enforcing multi-factor authentication (MFA), and implementing strong transport security measures such as TLS and HSTS to protect communications and reduce the attack surface. Industry experts emphasize that organizations should treat this guidance as a critical call to action, urging security teams to refine threat models, conduct tabletop exercises, and foster collaboration between IT, DevOps, and business leaders. The guidance highlights the importance of consistent patching, least privilege, and segmentation as foundational defenses against ongoing threats targeting Exchange environments. Organizations are encouraged to use this opportunity to reassess their security investments and ensure robust protection for their communication infrastructure.
Jul 12, 2026
Cybersecurity authorities including CISA and NSA, in collaboration with international partners, have issued urgent guidance to secure on-premise Microsoft Exchange Server and Windows Server Update Services (WSUS) instances. The recommendations emphasize restricting administrative access, enforcing multi-factor authentication, maintaining strict security baselines, and decommissioning end-of-life servers to mitigate ongoing threats. Organizations are urged to apply security updates promptly, enable advanced security features, and adopt zero trust principles to defend against persistent malicious activity targeting these critical Microsoft services. Simultaneously, a newly disclosed vulnerability in WSUS, tracked as CVE-2025-59287, is being actively exploited by cybercriminals to deploy the Skuld Stealer malware. Despite Microsoft's initial and subsequent out-of-band patches, attackers have leveraged the flaw to gain remote control over WSUS servers, using legitimate tools like PowerShell and cURL for malicious purposes. The exploitation prompted CISA to add the vulnerability to its list of known exploited vulnerabilities, underscoring the urgency for organizations to implement the latest security updates and follow best practices to protect their infrastructure.
Jun 29, 2026
Microsoft issued guidance for **CVE-2025-53786**, a high-severity vulnerability in hybrid **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition** deployments that can let an attacker with administrative access to an on-premises Exchange server escalate privileges into the connected cloud tenant. The issue stems from hybrid environments using a **shared service principal** tied to the Exchange Online application, creating a trust path that could enable unauthorized access to cloud data and services; Microsoft said it had not observed active exploitation but warned abuse would be difficult to detect. The company has been moving customers away from that shared identity model under its Secure Future Initiative, releasing **April 2025 Hotfix Updates** to support migration to a **dedicated Exchange hybrid application** in **Microsoft Entra ID**. Organizations that rely on hybrid "rich coexistence" features such as Free/Busy, MailTips, and profile photo sharing must complete the dedicated-app migration before **October 2025**, when Exchange Online will stop allowing the shared service principal approach, and later transition hybrid calls from **EWS** to **Microsoft Graph** permissions before **October 2026** as Exchange Online retires legacy EWS-based integration.
Jul 24, 2026