Microsoft Exchange bugs top list of exploited vulnerabilities affecting financial sector

CVE-2015-1635 is a remote code execution flaw in HTTP.sys, the kernel-mode HTTP protocol stack component of Microsoft Windows that handles HTTP(S) traffic for IIS and other web-facing Windows roles. A remote, unauthenticated attacker can trigger it by sending specially crafted HTTP requests to a system listening via HTTP.sys, most commonly an internet-facing IIS web server. Successful exploitation yields arbitrary code execution with kernel/system-level privileges on the target server, giving the attacker full control of the host. Any Windows deployment where HTTP.sys is reachable is affected - typically IIS web servers and web-facing roles such as Exchange or WSUS - although the source data does not specify exact version ranges. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with a ~100% EPSS probability of exploitation within 30 days, indicating active exploitation; public proof-of-concept code is not noted in the data and ransomware use is unknown.

Do: Apply Microsoft updates per vendor instructions (this CVE is addressed by the April 2015 MS15-034 bulletin) on every Windows system where HTTP.sys is reachable, prioritizing internet-facing IIS, Exchange, and WSUS hosts. Inventory your environment for systems running web-facing Windows roles and, if patching must be delayed, restrict inbound HTTP/80 and HTTPS/443 from untrusted sources or filter malformed HTTP requests at a front-end proxy/WAF. As a CISA KEV entry, this is a required patch for federal agencies; treat it as urgent everywhere else.

CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.

Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use.

On-premises Microsoft Exchange Server contains an elevation-of-privilege flaw (CWE-287, improper authentication) in which Exchange performs an incorrect lookup of security descriptors for requests proxied to the Exchange PowerShell API. The flaw is reached through the Autodiscover endpoint and was published as the middle step of the 'ProxyShell' attack chain, where an unauthenticated attacker chains it with an SSRF bug (CVE-2021-34473) and a post-authentication RCE (CVE-2021-33768) to move from no access to running arbitrary code on the server. Successful exploitation lets an attacker impersonate a privileged Exchange account, gaining elevated privileges in the Exchange organization and, when chained, arbitrary code execution on the Exchange host. Any on-premises Exchange deployment is affected (Microsoft's advisory covers Exchange Server 2013, 2016, and 2019), with the greatest risk on servers whose Autodiscover/OWA endpoints are reachable from the internet. Exploitation is confirmed in the wild — the flaw is on CISA's KEV catalog (added 2021-11-03) with known ransomware use and an EPSS probability of 100% — even though no public proof-of-concept is known.

Do: Apply Microsoft's July 2021 Exchange Server security updates for Exchange 2013, 2016, and 2019 as CISA's required action directs, prioritizing internet-facing servers given known ransomware use. Reduce exposure of Autodiscover/OWA endpoints (restrict to VPN or trusted networks where possible) and review IIS logs for suspicious requests to autodiscover/PowerShell endpoints as evidence of prior ProxyShell exploitation.

CVE-2021-31207 is a security feature bypass in Microsoft Exchange Server, classified as an unrestricted file-write issue (CWE-434) that lets an attacker bypass intended restrictions and write files of their choosing to the server. It is the final bug in the ProxyShell chain: chained with the autodiscover SSRF and PowerShell backend elevation flaws, it allows an unauthenticated attacker to reach the Exchange PowerShell API, write arbitrary files such as an ASPX webshell, and execute code with SYSTEM privileges. A successful attacker gains full control of the on-premises Exchange server, including mailbox access, stolen credentials, and a foothold for lateral movement; the bug has been used to deploy ransomware and keyloggers. On-premises deployments of Microsoft Exchange Server (2013, 2016, and 2019 per vendor advisories) are affected, while Exchange Online/cloud mailboxes are not. Exploitation is essentially certain and ongoing: the flaw is in CISA's KEV (added 2021-11-03) with known ransomware use, public ProxyShell PoC/exploit code is available, and EPSS puts the 30-day exploitation probability at 99.8%.

Do: Apply Microsoft's July 2021 security updates for Exchange Server 2013, 2016, and 2019 (or any later security/cumulative update) per vendor instructions, and restrict untrusted access to Exchange's autodiscover and PowerShell endpoints. Hunt for ASPX webshells under the Exchange FrontEnd directories and review IIS logs for autodiscover.json requests chaining PowerShell, since many servers were compromised before patching. Given known ransomware use and KEV listing, treat any server that was unpatched or internet-exposed during the exploitation window as potentially compromised.