CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Exchange Server 2016 and 2019 environments where Cumulative Updates and Extended Protection are not enabled.

[Impact] Unauthenticated remote attackers can perform NTLM credential relay attacks to elevate privileges, gaining administrative access to Exchange servers and compromising mailboxes.

[Mitigation] Upgrade Exchange Server to the latest Cumulative Update (CU) and enforce the Extended Protection feature immediately.

[Affected Scope] Microsoft SharePoint Server 2019 and SharePoint Server Subscription Edition.

[Impact] An unauthenticated attacker can send a specially crafted JWT token to bypass authentication, gain administrator privileges, and potentially chain it with RCE vulnerabilities.

[Mitigation] Apply the official Microsoft Cumulative Update (CU) immediately and restrict unauthorized access at the network and IIS levels prior to patching.

[Affected Scope] All supported desktop versions of Microsoft Outlook for Windows, including Outlook 2013, 2016, LTSC 2021, and Microsoft 365 Apps

[Impact] Attackers can trigger the vulnerability silently without user interaction (Zero-Click) simply by sending a malicious email, leaking the user's NTLM hash to external servers for NTLM relay attacks

[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB traffic (TCP port 445) at the perimeter, and run the Exchange audit script to purge malicious items

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

[Impact] Attackers can elevate privileges to SYSTEM, enabling remote code execution (RCE) when chained with other ProxyShell vulnerabilities

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange IIS ports