April 2021 Exchange Server Security Updates

Microsoft released several security updates (SUs) for Microsoft Exchange Server to address vulnerabilities. Due to the critical nature of these vulnerabilities, we recommend that customers apply the updates to affected systems immediately to protect the environment.

Microsoft has released a set of out of band security updates for vulnerabilities for the following versions of Exchange Server:

• Exchange Server 2013
• Exchange Server 2016
• Exchange Server 2019

Security updates are available for the following specific versions of Exchange:

• Exchange Server 2013 (CU23)
• Exchange Server 2016 (CU19, CU20)
• Exchange Server 2019 (CU8, CU9)

If you are not at these Exchange Server CU versions, please update right now and apply the above patch.

Vulnerabilities addressed in the April 2021 security updates were responsibly reported to Microsoft by a security partner. Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment.

We recommend prioritizing installing updates on Exchange Servers that are externally facing. All affected Exchange Servers should ultimately be updated.

Further information and guidance  

• Microsoft Security Response Center (MSRC)
• Exchange Team Blog
• CVE-2021-28480
• CVE-2021-28481
• CVE-2021-28482
• CVE-2021-28483