Security incident · checklist estimated
Exchange Server 2016 and 2019 deemed permanently vulnerable
Tier C · Keep an eye on it – Check if you’re affected
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
The Brief
- Microsoft says Exchange Server 2016 and 2019 are 'permanently vulnerable'.
- November's security fixes are released for Exchange Server Subscription Edition (SE) only.
Why it matters
Servers still running Exchange Server 2016 or 2019 will not receive these security fixes, so their exposure will persist unless they move to a supported version.
The checklist behind the tier
Checklist · 1 of 10 yes · estimated from older data, not yet checked against the sources
| Yes | Hits tech teams | Does it affect software, devices or services that developers, ops or IT teams build with, run or are responsible for? |
| No | Core infrastructure | Is the flaw in, or the compromise of, software that nearly every team runs? |
| No | Popular tool | Is the flaw in, or the compromise of, a widely used framework, tool, platform, OS or package? |
| No | Exploited in the wild | Do sources report real attacks using it? |
| No | Public exploit | Is a working exploit or detailed proof-of-concept public? |
| No | Remote, no login | Can an attacker use it over the network without credentials or user interaction? |
| No | Full takeover | Does it lead to code execution, root/admin rights or full account takeover? |
| No | Secrets exposed | Were credentials, tokens, keys, configs, source code or customer data stolen or exposed? |
| No | Supply chain | Was malicious code shipped through a channel developers trust? |
| No | No fix yet | Is there no patched version yet? |
Timeline
Microsoft's November release documentation calls Exchange Server 2016 and 2019 'permanently vulnerable' and security fixes arrive for Subscription Edition only
www.theregister.com - Articles
Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era
Source
Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era ↗ www.theregister.com - Articles · 54 min ago
First seen · 1 source · Full story page · How tiers are decided