One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 7215318 |
| Date de publication | 2022-09-29 20:51:28 (vue: 2022-09-30 04:07:22) |
| Titre | Possible New Microsoft Exchange RCE 0-day Being Exploited in the Wild |
| Texte | Note: This is a breaking news event. All information and updates related to this event will be updated once relevant information is available. FortiGuard Labs is aware of reports that an unpatched Microsoft Exchange vulnerability is being exploited in the wild. It is a Remote Command Execution (RCE) vulnerability, as such successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. At the time of this writing, patches and CVE assignments are not available. Also, Microsoft has not commented or confirmed that this is a zero day vulnerability.Why is this Significant?This is significant because this is likely a new unpatched Remote Command Execution (RCE vulnerability). Successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. Microsoft Exchange is widely used in Enterprise and an unpatched vulnerability poses a serious threat to many organizations worldwide.When was the Vulnerability Discovered?On September 28, 2022, GTSC (security vendor) published a blog on an unpatched Microsoft Exchange vulnerability which was leveraged in an attack against an unnamed critical infrastructure. Has Microsoft Released a Patch for the Vulnerability?At the time of this writing (September 29, 2022), Microsoft has not released a patch for the vulnerability.Has the Vendor Released an Advisory for the Vulnerability?No, Microsoft has not released an advisory at the time of this writing (September 29, 2022). Microsoft has yet to confirm that this is a new zero-day or vulnerability.What is the Status of Coverage?FortiGuard Labs is closely monitoring the situation and will update this Threat Signal once protections are available. All network IOCs on the GTSC blog are blocked by the WebFiltering client.What Mitigation Steps are Available?GTSC provided potential detection and mitigation information in their blog. Note that those detection and mitigation have not been verified by FortiGuard Labs. For additional information, see the Appendix for a link to "WARNING: NEW ATTACK CAMPAIGN UTILIZED A NEW 0-DAY RCE VULNERABILITY ON MICROSOFT EXCHANGE SERVER". |
| Envoyé | Oui |
| Condensat | 2022 additional advisory affected against all allow also appendix are assignments attack attacker available aware because been being blocked blog breaking campaign client closely command commands commented confirm confirmed could coverage critical cve day detection discovered enterprise event exchange execute execution exploitation exploited fortiguard gtsc has have information infrastructure iocs labs leveraged likely link many microsoft mitigation monitoring network new news not note note: once organizations patch patches poses possible potential protections provided published rce related released relevant remote reports security see september serious server servers signal significant situation status steps successful such those threat time unnamed unpatched update updated updates used utilized vendor verified vulnerability warning: webfiltering what when which why widely wild will worldwide writing yet zero |
| Tags | Threat Vulnerability |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.