# MA-800.032021: MyCERT Alert - Advisory Multiple Security Updates Released for Exchange Server

**Date:** 04 Mar 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-800.032021  
**Advisory ID:** MA-800.032021

---

**1.0 Introduction**
Microsoft has released out-of-band security updates to address vulnerabilities affecting Microsoft Exchange Server 2010, 2013, 2016, and 2019.
**2.0 Impact**
A remote attacker can exploit four remote code execution vulnerabilities—CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065—to take control of an affected system and can exploit one vulnerability—CVE-2021-26855—to obtain access to sensitive information. These vulnerabilities are being actively exploited in the wild.
**3.0 Affected System and Devices**
- Microsoft Exchange Server 2010
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
**4.0 Recommendations**
Users and system administrators are advised to review the following URL and apply the necessary updates:
- <https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/>
Generally, MyCERT advises the users of this application to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://us-cert.cisa.gov/ncas/current-activity/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server>
2. <https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/>
3. <https://www.tenable.com/blog/cve-2021-26855-cve-2021-26857-cve-2021-26858-cve-2021-27065-four-microsoft-exchange-server-zero-day-vulnerabilities>