Security update for Exchange

Question

Hi All,

I am using an Exchange 2016 hybrid environment. My Exchange servers are running on Exchange Server 2016 CU23 Nov24SUv2. We have a third-party vulnerability scanning tool, and it has detected the following vulnerability on my Exchange servers:

Security updates for Microsoft Exchange Server (February 2024).

I assumed that Exchange Server 2016 CU23 Nov24SUv2 would fix this vulnerability. Could you please guide me on how to resolve it?

[PS] C:\windows\system32>Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo}

ProductVersion   FileVersion      FileName
--------------   -----------      --------
15.01.2507.044   15.01.2507.044   C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetup.exe


[PS] C:\windows\system32>Get-Command Exsetup.exe | fl


Name            : ExSetup.exe
CommandType     : Application
Definition      : C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetup.exe
Extension       : .exe
Path            : C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetup.exe
FileVersionInfo : File:             C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetup.exe
                  InternalName:     ExSetup.exe
                  OriginalFilename: ExSetup.exe
                  FileVersion:      15.01.2507.044
                  FileDescription:
                  Product:          Microsoft® Exchange
                  ProductVersion:   15.01.2507.044
                  Debug:            False
                  Patched:          False
                  PreRelease:       False
                  PrivateBuild:     False
                  SpecialBuild:     False
                  Language:         Language Neutral

Answer 1

Hi @Glenn Maxwell ,

Welcome to the Microsoft Q&A platform!

Microsoft has released KB5035606 to address this issue or enable Extended Protection for Authentication (EPA) to prevent this vulnerability.

Since updates have been suspended for the 2016 version, it is recommended to upgrade to 2019 if possible to avoid potential vulnerabilities.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Run the health checker against your server:

https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/

If you are missing a setting like enabling extended protection, then you can do that by following:

https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019