Loading vulnerability…
NTLM Relay Elevation of Privilege in Microsoft Exchange Server
CVE-2024-21410 is a critical elevation-of-privilege vulnerability affecting Microsoft Exchange Server. Successful exploitation allows a remote, unauthenticated attacker to obtain NTLM authentication material from a targeted user and relay the leaked Net-NTLMv2 hash to a susceptible Exchange Server, authenticating as that user. The issue is described as an NTLM credential leakage and relay scenario rather than direct memory corruption or classic remote code execution. Microsoft guidance indicates the attack can involve targeting an NTLM client such as Outlook to trigger credential leakage, after which the attacker relays the authentication exchange to Exchange and performs actions in the victim’s security context. Microsoft later updated the advisory to indicate exploitation had been detected in the wild. Extended Protection for Authentication is identified as the key defensive control that addresses this vulnerability on supported Exchange versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who successfully exploits this vulnerability can impersonate a legitimate Exchange user and perform operations on that user’s behalf. The practical impact includes unauthorized access to Exchange-backed resources and user capabilities, with resulting loss of confidentiality and integrity. Because the flaw enables authentication as the victim user through NTLM relay, it can be used to expand an attacker’s foothold, access mailbox-related functionality available to the compromised identity, and facilitate follow-on actions within the messaging environment. The vulnerability is rated critical and has been reported as actively exploited.
If you can’t patch tonight, do this now.
Enable Extended Protection for Authentication on all supported Exchange servers after validating prerequisites. Before enabling it broadly, verify environment readiness using Microsoft’s recommended health-check and Extended Protection management tooling, especially in deployments with load balancers, SSL offloading, hybrid publishing, or TLS configuration mismatches. Where SSL offloading is in use, move to a supported configuration such as SSL bridging consistent with Microsoft guidance. Increase monitoring for suspicious NTLM relay activity, anomalous Exchange authentication patterns, and operations performed in unexpected user contexts. Because patching does not remediate prior compromise, investigate for historical abuse if exposure is suspected.
Patch, then assume compromise.
Apply Microsoft’s February 2024 security updates and follow the vendor’s specific hardening guidance for CVE-2024-21410. On Exchange Server 2019, deploy Cumulative Update 14 or later as appropriate, noting that Microsoft changed setup behavior to enable Extended Protection by default. On supported Exchange versions, ensure Extended Protection for Authentication is enabled because patching alone may be insufficient if the recommended configuration changes are not implemented. For Exchange Server 2016, administrators should follow Microsoft’s advisory guidance carefully, as remaining fully patched without the prescribed Extended Protection measures does not fully address the issue.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.