Is running our own Exchange server and Outlook on the web a risk?
It can be.
Last read from the sources at the foot of this page.
What is on-premises Exchange?
Microsoft Exchange Server Remote Code Execution Vulnerability 2022-09-30 Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Some firms still run Microsoft Exchange on their own server for email. Outlook on the web, often at a name like mail or owa, puts its sign-in page on the internet.
Why does it matter?
Disconnect all servers not eligible for the April 2025 Hotfix Updates (HUs), to include end-of-life Microsoft Exchange servers identified by the Exchange Server Health Checker script.
CISA's Emergency Directive 25-02, issued 7 August 2025, required agencies to disconnect all servers not eligible for the April 2025 hotfix updates, to include end-of-life Exchange servers.
Older flaws still matter. CISA added the "ProxyNotShell" remote code execution flaw in Exchange Server to its catalog of exploited flaws on 30 September 2022.
What do I do about it?
- Find out which Exchange version and update level you run with Microsoft's Health Checker script.
- Disconnect any Exchange server that no longer gets updates.
- Move mailboxes to a supported, updated service if you can.
- If you keep Exchange, install every security update and limit who can reach Outlook on the web.
Where does this come from?
- CISA: ED 25-02, Mitigate Microsoft Exchange Vulnerabilitycisa.govRead 14 October 2026
- CISA: Known Exploited Vulnerabilities catalog, CVE-2022-41082cisa.govRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/