Microsoft Exchange Service Instantly Mitigates High-Risk Bugs

Share post:

Microsoft recently added a new Exchange Server feature that automatically applies interim mitigations for high-risk and likely actively exploited security vulnerabilities to protect on-premises servers from incoming attacks and give administrators more time to install security updates.

This comes after multiple Microsoft Exchange zero-day vulnerabilities were exploited by state-sponsored and financially motivated cybercriminals to impact servers whose administrators did not have patch or mitigation information available.

Microsoft Exchange Emergency Mitigation (EM) service, the name of the new Exchange Server component, builds on Microsoft’s Exchange On-premises Mitigation Tool (EOMT), launched last March to help customers minimize the attack surface exposed by the ProxyLogon bugs.

EM works as a Windows service on Exchange Mailbox servers and is automatically installed on servers with the Mailbox role after the CU is installed on Exchange Server 2016 or Exchange Server 2019 in September 2021.

This works by identifying Exchange Servers vulnerable to one or more known threats and applies interim mitigations until a security update is available for installation.

Automatically applied mitigations via the EM service are temporary solutions until the security update that fixes the vulnerability can be installed, and are not a replacement for Exchange SUs.

Once installed on an Exchange email server, the EM service can perform three types of mitigations:

  • IIS URL Rewrite rule mitigation: a rule that blocks certain patterns of malicious HTTP requests that may compromise an Exchange server.
  • Exchange service mitigation: disables a vulnerable service on an Exchange server.
  • App Pool mitigation: disables a vulnerable app pool on an Exchange server.

Admins can disable the EM service if they prefer not to automatically mitigate their Exchange servers.

They may also control applied mitigations using PowerShell cmdlets and scripts, reapply, block, or delete mitigation actions.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday, March 1, 2024

This episode features a discussion on how hard it is to kill a ransomware gang, Canada's proposed new online harms bill, why organizations still allow staff to use vulnerable software

Healthcare sector “stretched thin” in fight against cyber attacks warns CSO of Health-ISAC

In an interview Errol Weiss talks about the challenges facing hospitals a

Cyber Security Today, March 1, 2024 – Warnings to GitHub users and Ivanti gateway administrators, and more

This episode reports on a recommendation that enterprises drop Ivanti Policy Secure and Connect Secure devices because threat actors can get around mitigations for recent vulne

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways