Microsoft says 92% of vulnerable Exchange servers have been patched/mitigated, and reiterates that patches do not necessarily remove the access of the attacker
If you're cleaning up a infected Exchange server, you need to look for traces of multiple threats, warns Microsoft.
Context & Ripple Effects
Microsoft's patching update comes after reporting that the company had known of Exchange flaws for nearly two months before issuing fixes, while a mass compromise was unfolding. Separately, ESET identified at least ten largely state-backed groups exploiting the vulnerabilities across thousands of servers, making patch adoption an incomplete measure of recovery.
The key change is operational: the reported patch or mitigation rate does not establish that affected organizations have evicted intruders. Microsoft is framing Exchange cleanup as an incident-response task, not a routine update cycle.
First-order effects
- Exchange administrators that found an infection must investigate for multiple threats and attacker access even after applying Microsoft's fixes or mitigations.
- Microsoft's 92% remediation figure now describes exposure reduction rather than a clean bill of health for the servers included in that tally.
Second-order effects
- Organizations responding to the Exchange incident must move from patch deployment into forensic triage and remediation, because a patched server may still require cleanup.
- The earlier delay between disclosure to Microsoft and the patch release raises the cost of that transition: systems exposed during the mass-hack period require attention beyond their current patch state.
Third-order effects
- If this response model holds, enterprise vulnerability programs will be judged less by patch-compliance rates and more by whether they detect and remove persistence after active exploitation.
- The Exchange episode points to a security-operations model in which broad exploitation by multiple groups turns vendor patch releases into the start of recovery work rather than its endpoint.
The trend: Widely exploited enterprise-software flaws are making post-patch threat hunting and recovery a core part of vulnerability management.