It has been Patch Tuesday again and Microsoft has released a new set of important Exchange Security Updates, released together with this month’s Microsoft Updates.
It is important to keep Your Exchange Servers up-to-date, see the blog post from the Exchange Team on this: Protect Your Exchange Servers
The latest Exchange Security Updates address vulnerabilities found in the following Exchange Servers:
- Exchange 2016 CU23
- Exchange 2019 CU12 and CU13
For more about the vulnerabilities, see the CVEs:
- CVE-2023-36726 – Windows Internet Key Exchange (IKE) Extension Elevation of Privilege Vulnerability
- CVE-2023-36778 – Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2023-36780 – Skype for Business Remote Code Execution Vulnerability
Issued resolved in this release
- Users in account forest can’t change expired password in OWA in multi-forest Exchange deployments af…
- Extended Protection causes Outlook for Mac to fail to download the OAB (we are releasing the new version of the Extended Protection script)
The Security Update is available for the specific Cumulative Update level (CU) your Exchange is running, if you are not up-to-date, with the latest CU, you might have to update the CU before applying the Security Update.
The update path is the following:
If you are uncertain, about what Exchange Server updates are needed and what current build, your Exchange Servers are running, you can use the Exchange Server Health Checker script to inventory your servers.
If you only have an Exchange Hybrid running, you will still need to update your Exchange environment. You do not need to re-run the Hybrid Configuration Wizard (HCW) after applying updates.
Read the full process on this, on the Exchange Team blog:
Use the Exchange Update Wizard, if any doubt about the upgrade process:
If you manually install the Exchange Security Updates, the Security Updates can be downloaded here:
Download the Security Update that is specific to the CU, your Exchange Server is running.
Remember if you install them manually, the install (.msp file) needs to be run from an elevated command prompt.
More details from the original Exchange Team blog post:
It is recommended to update your Exchange Servers as soon as possible. Remember to test the updates if possible in your test environment, before implementing them in production.
/Happy Patching! 🙂