Critical Microsoft Exchange Server Vulnerability

Microsoft has patched an exploited zero-day vulnerability in Microsoft Exchange Server. The vulnerability is tracked as CVE-2024-21410 with a CVSS score of 9.8. It allows unauthenticated threat actors to escalate privileges in NTLM relay attacks. Threat actors can leverage Windows NT Lan Manager (NTLM) credential leaks on clients (e.g., Outlook) and relay these credentials against a vulnerable Exchange Server impersonating the targeted user. Successful exploitation grants unauthorized access to elevate privileges and perform malicious activities. Microsoft also patched a critical Remote Code Execution (RCE) vulnerability in Outlook. The vulnerability tracked as CVE-2024-21413 with a CVSS score of 9.8. It can be triggered by specially crafted hyperlinks using the 'file://' protocol. Successful exploitation of the vulnerability allows threat actors to bypass Office Protected View and remotely execute malicious code which allows various attacks such as data theft, malware execution, privilege escalation, and victim impersonation.