Vulnerabilityhigh

Automatically mitigate ProxyLogon, detect IoCs associated with SolarWinds attackers' activities

Help Net Securityby @zeljkazorzMar 19, 2021 · 00:00 UTC (Mar 19, 2021)2 min read2

Read at helpnetsecurity.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Tags: cve-2021-26855 cve-2021-26857 cve-2021-26858 cve-2021-27065 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-26855 +3 related CVEs CVE-2021-27065 CVE-2021-26857 CVE-2021-26858	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1 group max	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021

From the original article

2 min read at helpnetsecurity.com

Microsoft has updated its Defender Antivirus to mitigate the ProxyLogon flaw on vulnerable Exchange Servers automatically, while the Cybersecurity and Infrastructure Security Agency (CISA) has released CHIRP, a forensic tool that can help defenders find IoCs associated with the SolarWinds attackers’ activities.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.