Menu
Ask us how we can help secure your environment with the top 10-12 security enhancements every firm should have. #ITCornerView
April 15, 2021
Alert 1: Mitigate New Microsoft Exchange Server Vulnerabilities
Alert 2: Zero-Day Exploits for Google Chrome and Microsoft Edge – Update Now!
Urgency/Severity: CRITICAL
An attacker could use these vulnerabilities to gain access and maintain persistence on the target host. These vulnerabilities are different from the ones disclosed and fixed in March 2021 – the security updates released in March 2021 will not remediate against these vulnerabilities. CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. CVE-2021-28480 and CVE-2021-28481 have a critical severity score of 9.8 out of 10 and could be exploited without authentication.
Businesses using Microsoft On-Premises Exchange Server 2013, 2016 and 2019
Though CISA is unaware of active exploitation of these vulnerabilities, once an update has been publicly released, the underlying vulnerabilities can be reverse engineered to create an exploit. CISA requires that agencies immediately apply the Microsoft April 2021 update to all affected Exchange Servers.
Exchange Server 2013 CU23
Exchange Server 2016 CU19 and CU20
Exchange Server 2019 CU8 and CU9Two update paths provided by Microsoft:
Urgency/Severity: HIGH
On Tuesday, Google released a fix on the reported 2 critical and exploitable flaws in their browser, Google Chrome:
Reports indicates that Microsoft Edge and other Chromium-based browsers like Brave, Opera and Vivaldi are also at risk.
User who are using Google Chrome browser, Microsoft Edge
Latest Chrome version as of this writing 90.0.4430.72 is available. Users can update to the latest version by heading to
Settings > Help > About Google Chrome
to mitigate the risk associated with the flaws. This goes the same with Microsoft Edge where the most recent version as of writing is 89.0.774.77. To upgrade their browser version, go to Settings > Help and Feedback > About Microsoft Edge
Urgency/Severity: HIGH
Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. Please click below respective Cisco advisory links on how to remediate affected products:
Businesses using the affected Cisco products listed above
CISA strongly urge businesses and users to assess Cisco products their using and check the Cisco Security Advisory links posted for any workarounds or fixed software version released by Cisco.
