Please help! what vulnerability that I got and how to fix?

Question

Dear All,

My customer Exchange Server is the Exchange 2019 CU12 May 22SU.

I found these alerts in the Crowdstrike detection regarding attacking via w3wp.exe.

Please see the pictures below. How can I fix this vulnerability or any suggestion?

Thank you very much,

Tanisorn.

Answer 1

Hi @Tanisorn Sowudomsilp ，

It is recommended that you use the Exchange Server Health Checker script to check for specific vulnerabilities in the exchange server to determine which updates are required.

 

In addition , Microsoft has released the January 2023 Exchange Server security update.

Although we are not aware of any active exploits in the wild, our recommendation is to immediately install these updates to protect your environment.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread

Answer 2

Here is the detailed guide for help - https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits/ 

https://redcanary.com/blog/microsoft-exchange-attacks/

Answer 3

The problem was resolved by updated Exchange Server security update sir.

Thank you very much,

Tanisorn