Security Updates Exchange 2010-2019

A quick blog that rather silently, Microsoft published hotfixes for a number of products few days ago, including Exchange Server 2010 up to Exchange Server 2019. These fixes address the following vulnerabilities:

  • CVE-2019-1084: Microsoft Exchange Information Disclosure Vulnerability, allowing non-printable characters to be added to Display Names.
  • CVE-2019-1136: Microsoft Exchange Server Elevation of Privilege Vulnerability, allowing NTLM MITM elevation permissions or impersonation through Exchange Web Services. This sounds like a variation on the NTLM MITM exploit which was fixed earlier this year with the February update cycle.
  • CVE-2019-1137: Microsoft Exchange Server Spoofing Vulnerability, allowing for cross-site scripting (XSS).

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

2019 CU2XXLink15.2.397.54509408
2019 CU1XXLink15.2.330.94509408
2016 CU13XXXLink15.1.1779.44509409
2016 CU12XXXLink15.1.1713.84509409
2013 CU23XXXLink15.0.1497.34509409
2010 SP3 RU29XXLink14.3.468.04509410

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU12 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4503027-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

1 thought on “Security Updates Exchange 2010-2019

  1. Also please be aware when you install a security update uninstall it before you apply an new CU. New cu’s and security updates are not allways the best combination. be aware 😉 and keep your envrionment healty and up and running 🙂


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.