Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server

0
High
Published: Tue Mar 09 2021 (03/09/2021, 00:00:00 UTC)
Source: CIRCL OSINT Feed
Vendor/Project: type
Product: osint

Description

In March 2021, Microsoft released security updates addressing vulnerabilities in older cumulative updates of Exchange Server. These vulnerabilities could allow attackers to deliver malicious payloads and drop artifacts on compromised systems. Although no known exploits in the wild were reported at the time, the severity was assessed as high due to the potential impact on confidentiality, integrity, and availability of Exchange Server environments. The lack of patches for some older versions increases risk for organizations that have not updated their Exchange Servers. European organizations relying on Exchange Server for email and collaboration services could face significant operational disruption and data breaches if exploited. Mitigation requires upgrading to supported cumulative updates and applying all relevant security patches. Countries with high Exchange Server deployment and critical infrastructure reliance on email services are most at risk. Given the ease of exploitation for unpatched systems and the critical role of Exchange Servers, the suggested severity is high. Defenders should prioritize patch management and monitor for suspicious activity related to payload delivery and artifact creation on Exchange servers.

AI-Powered Analysis

AILast updated: 12/24/2025, 06:09:58 UTC

Technical Analysis

The March 2021 Exchange Server security updates addressed vulnerabilities present in older cumulative updates of Microsoft Exchange Server. These vulnerabilities potentially allow attackers to deliver malicious payloads and drop artifacts on compromised systems, which could lead to unauthorized access, data exfiltration, or disruption of email services. The information does not specify exact CVEs or technical details about the vulnerabilities, but the classification under 'payload delivery' and 'artifacts dropped' suggests exploitation could involve remote code execution or privilege escalation. No patches were available for some older cumulative updates, increasing exposure for organizations that have not maintained current updates. Although no known exploits in the wild were reported at the time, the high severity rating reflects the critical nature of Exchange Server in enterprise environments and the potential for significant damage if exploited. The vulnerabilities affect older versions, emphasizing the importance of maintaining up-to-date cumulative updates. The lack of detailed technical indicators or exploits limits immediate detection capabilities, but organizations should be vigilant for unusual activity on Exchange servers. The threat highlights the ongoing risk posed by legacy software versions in critical infrastructure components such as email servers.

Potential Impact

For European organizations, the impact of these Exchange Server vulnerabilities could be substantial. Exchange Server is widely used across Europe for corporate email and collaboration, making it a high-value target. Exploitation could lead to unauthorized access to sensitive communications, data leakage, disruption of email services, and potential lateral movement within networks. Critical sectors such as finance, government, healthcare, and energy could face operational disruptions and reputational damage. The absence of patches for older cumulative updates means organizations that have not upgraded remain vulnerable, increasing the risk of targeted attacks. Additionally, the ability to deliver payloads and drop artifacts could facilitate persistent threats and advanced attacks. The impact extends beyond confidentiality to integrity and availability, potentially causing widespread business interruption and compliance violations under regulations like GDPR.

Mitigation Recommendations

European organizations should immediately verify the version and cumulative update level of their Exchange Server deployments. They must prioritize upgrading to the latest supported cumulative updates and apply all available security patches from Microsoft. For systems that cannot be upgraded promptly, implement compensating controls such as network segmentation, strict access controls, and enhanced monitoring for suspicious activity related to payload delivery and artifact creation. Employ endpoint detection and response (EDR) tools to detect anomalous behavior on Exchange servers. Regularly audit Exchange server logs for unusual access patterns or unauthorized changes. Educate IT staff on the importance of patch management and maintaining supported software versions. Establish incident response plans specific to Exchange Server compromise scenarios. Finally, consider threat hunting exercises focused on indicators of compromise related to Exchange Server vulnerabilities.

Need more detailed analysis?Upgrade to Pro Console

Technical Details

Uuid
fd875781-262e-4159-a0cd-ac0241784cc7
Original Timestamp
1615361330

Indicators of Compromise

Hash

ValueDescriptionCopy
hash511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hashb75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash4b3039cf227c611c45d2242d1228a121
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash0ba9a76f55aaa495670d74d21850d0155ff5d6a5
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hashb75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash5544ba9ad1b56101b5d52b5270421d4a
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hashfc6f5ce56166d9b4516ba207f3a653b722e1a8df
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
hash511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

File

ValueDescriptionCopy
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\errorPages.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\fatal-erro.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\log.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\logg.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\logout.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\one.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\one1.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel2.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\shel90.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\a.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\default.aspx
fileC:\inetpub\wwwroot\aspnet_client\shell.aspx
fileC:\inetpub\wwwroot\aspnet_client\Server.aspx
fileC:\inetpub\wwwroot\aspnet_client\aspnet_client.aspx
fileC:\inetpub\wwwroot\aspnet_client\aspnet_iisstart.aspx
fileC:\inetpub\wwwroot\aspnet_client\aspnet_pages.aspx
fileC:\inetpub\wwwroot\aspnet_client\aspnet_www.aspx
fileC:\inetpub\wwwroot\aspnet_client\default1.aspx
fileC:\inetpub\wwwroot\aspnet_client\errorcheck.aspx
fileC:\inetpub\wwwroot\aspnet_client\iispage.aspx
fileC:\inetpub\wwwroot\aspnet_client\s.aspx
fileC:\inetpub\wwwroot\aspnet_client\session.aspx
fileC:\inetpub\wwwroot\aspnet_client\system_web\log.aspx
fileC:\inetpub\wwwroot\aspnet_client\xclkmcfldfi948398430fdjkfdkj.aspx
fileC:\inetpub\wwwroot\aspnet_client\xx.aspx
fileC:\inetpub\wwwroot\aspnet_client\discover.aspx
fileC:\inetpub\wwwroot\aspnet_client\HttpProxy.aspx
fileC:\inetpub\wwwroot\aspnet_client\OutlookEN.aspx
fileC:\inetpub\wwwroot\aspnet_client\supp0rt.aspx
file%PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\OAB\log.aspx

Link

ValueDescriptionCopy
linkhttps://techcommunity.microsoft.com/t5/exchange-team-blog/march-2021-exchange-server-security-updates-for-older-cumulative/ba-p/2192020
linkhttps://www.virustotal.com/gui/file/b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0/detection/f-b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0-1615293798
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
linkhttps://www.virustotal.com/gui/file/511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1/detection/f-511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1-1615284167
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

Text

ValueDescriptionCopy
textMarch 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server To help customers more quickly protect their environments in light of the March 2021 Exchange Server Security Updates, Microsoft is producing an additional series of security updates (SUs) that can be applied to some older (and unsupported) Cumulative Updates (CUs). The availability of these updates does not mean that you don’t have to keep your environment current. This is intended only as a temporary measure to help you protect vulnerable machines right now. You still need to update to the latest supported CU and then apply the applicable SUs. If you are already mid-update to a later CU, you should continue with that update.
text32/59
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
text18/58
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

Datetime

ValueDescriptionCopy
datetime2021-03-09T12:43:18+00:00
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.
datetime2021-03-09T10:02:47+00:00
To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed of observed indicators of compromise (IOCs). The feed of malware hashes and known malicious file paths observed in related attacks is available in both JSON and CSV formats at the below GitHub links. This information is being shared as TLP:WHITE.

Threat ID: 68359c9d5d5f0974d01f3b82

Added to database: 5/27/2025, 11:06:05 AM

Last enriched: 12/24/2025, 6:09:58 AM

Last updated: 2/4/2026, 4:25:22 PM

Views: 37

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats