Updates Microsoft Exchange Server Vulnerabilities

us-cert.cisa.gov • September 19, 2026

CISA has added seven Malware Analysis Reports (MARs) to Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities . Each MAR identifies a webshell associated with exploitation of the vulnerabilities in Microsoft Exchange Server products. After successful exploiting a Microsoft Exchange Server vulnerability for initial accesses, a malicious cyber actors can upload a webshell to enable remote administration of the affected system.

In addition to the MARs, CISA added information on ransomware activity associated with exploitation of the Exchange Server products, including DearCry ransomware.

CISA encourages users and administrators to review the following resources for more information.

Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities

MAR-10328877-1.v1: China Chopper Webshell

MAR-10328923-1.v1: China Chopper Webshell

MAR-10329107-1.v1: China Chopper Webshell

MAR-10329297-1.v1: China Chopper Webshell

MAR-10329298-1.v1: China Chopper Webshell

MAR-10329301-1.v1: China Chopper Webshell

MAR-10329494-1.v1: China Chopper Webshell

CISA’s Remediating Microsoft Exchange Vulnerabilities web page

CISA’s Ransomware Guidance and Resources web page

This product is provided subject to this Notification and this Privacy & Use policy.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Disrupts Chinese State-Sponsored Exploitation of Microsoft Exchange Vulnerabilities On April 13, 2021, the FBI executed a novel operation to remove malicious web shells from U.S.-based computers, attributed to the Chinese state-sponsored group Hafnium. These web shells exploited zero-day vulnerabilities in Microsoft Exchange servers, allowing unauthorized access and persistent malware deployment. Despite prior mitigation efforts, hundreds of web shells remained on affected systems. The FBI's warrant permitted remote access to copy and delete these web shells without the owners' knowledge. The operation targeted systems with particularly difficult-to-detect web shells, which had unique file names. The warrant was partially unsealed following the operation's conclusion, allowing the FBI to notify victims through emails and public postings. The FBI's actions represent a significant escalation in countering state-sponsored cyber threats. 2 sources 63

Extracted Entities

Updates Microsoft Exchange Server Vulnerabilities

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)