Note: This is a breaking news event. All information and updates related to this event will be updated once relevant information is available. FortiGuard Labs is aware of reports that an unpatched Microsoft Exchange vulnerability is being exploited in the wild. It is a Remote Command Execution (RCE) vulnerability, as such successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. At the time of this writing, patches and CVE assignments are not available. Also, Microsoft has not commented or confirmed that this is a zero day vulnerability.Why is this Significant?This is significant because this is likely a new unpatched Remote Command Execution (RCE vulnerability). Successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. Microsoft Exchange is widely used in Enterprise and an unpatched vulnerability poses a serious threat to many organizations worldwide.When was the Vulnerability Discovered?On September 28, 2022, GTSC (security vendor) published a blog on an unpatched Microsoft Exchange vulnerability which was leveraged in an attack against an unnamed critical infrastructure. Has Microsoft Released a Patch for the Vulnerability?At the time of this writing (September 29, 2022), Microsoft has not released a patch for the vulnerability.Has the Vendor Released an Advisory for the Vulnerability?No, Microsoft has not released an advisory at the time of this writing (September 29, 2022). Microsoft has yet to confirm that this is a new zero-day or vulnerability.What is the Status of Coverage?FortiGuard Labs is closely monitoring the situation and will update this Threat Signal once protections are available. All network IOCs on the GTSC blog are blocked by the WebFiltering client.What Mitigation Steps are Available?GTSC provided potential detection and mitigation information in their blog. Note that those detection and mitigation have not been verified by FortiGuard Labs. For additional information, see the Appendix for a link to “WARNING: NEW ATTACK CAMPAIGN UTILIZED A NEW 0-DAY RCE VULNERABILITY ON MICROSOFT EXCHANGE SERVER”.
