Microsoft updates Defender Antivirus to mitigate Exchange server vulnerabilities

Microsoft is in a damage control mode after it revealed cybercriminals were exploiting vulnerabilities in its Exchange Server. Already, it has rolled out multiple patches to fix the loopholes. Earlier this week, the company also updated Microsoft Defender Antivirus to prevent critical vulnerabilities.

The company said the update would automatically block the CVE-2021-26855, one of the four vulnerabilities used for cyberattacks.

According to an Engadget report, the CVE-2021-26855 serves as the entry. Thus, its blocking would make it difficult for cybercriminals to access the other three vulnerabilities. Microsoft noted that its customers do not need to act beyond ensuring they have installed the latest version of intelligence update (build 1.333.747.0 or newer) if the automatic updates are not enabled.

“The Exchange security update is still the most comprehensive way to protect your servers from these attacks and others fixed in earlier releases. This interim mitigation is designed to help protect customers while they take the time to implement the latest Exchange Cumulative Update for their version of Exchange,” the company said in a post.

Before the update to Defender Antivirus, Microsoft had launched a one-click mitigation tool for smaller companies. The tool is much easier to install for companies, especially those who do not have dedicated security IT teams.

According to Microsoft, the mitigation tool will help mitigate the CVE-2021-26855 on any Exchange server deployed. Microsoft warned that the tool was not an alternative to the Exchange Security update but served as a quicker and simpler way to reduce the risks to companies on the platform.

Microsoft earlier this month revealed that the cybercriminals were exploiting vulnerabilities in Microsoft Exchange servers to target organisations worldwide. According to a CheckPoint report, the US faced the most attack at 17% followed by Germany (6%) and the UK (5%). Firms in India have also been targeted by criminals who exploited the Exchange Server. It said that state-sponsored hackers were mostly using the vulnerability. The $50 million ransomware case with Acer, however, suggests other hacker groups are also exploiting it.