I have been away for a couple of days, but you already might have seen that Microsoft released a number of Security Updates for Exchange 2019, Exchange 2016 and Exchange 2013, but only for the last two Cumulative Updates (as always).
Security Updates are available for the following products:
|Exchange version||Download||Knowledge Base|
|Exchange 2019 CU11||https://www.microsoft.com/en-us/download/details.aspx?id=103643||KB5007409|
|Exchange 2019 CU10||https://www.microsoft.com/en-us/download/details.aspx?id=103642||KB5007409|
|Exchange 2016 CU22||https://www.microsoft.com/en-us/download/details.aspx?id=103644||KB5007409|
|Exchange 2016 CU21||https://www.microsoft.com/en-us/download/details.aspx?id=103645||KB5007409|
|Exchange 2013 CU23||https://www.microsoft.com/en-us/download/details.aspx?id=103646||KB5007409|
The following vulnerabilities are addressed in these updates:
- CVE-2021-42321 (Remote Code Execution, Important)
- CVE-2021-42305 (Spoofing, Important)
- CVE-2021-41349 (Spoofing, Important)
Security Updates are CU specific and can only be applied to the specific Cumulative Update. When trying to install a Security Update for another CU, an error message will be returned.
Security Updates are also cumulative, so this Security Update contains all previous security updates for this specific CU. There’s no need to install previous Security Updates before this Security Update.
As always, after downloading a Security Update, start the Security Update from a command prompt with elevated privileges (‘Run as Administrator’) to prevent an erratic installation. This does not apply when installing a Security Update via Windows Update or WSUS.