{"id":4094,"date":"2023-03-15T03:00:11","date_gmt":"2023-03-15T03:00:11","guid":{"rendered":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/"},"modified":"2023-03-15T03:00:11","modified_gmt":"2023-03-15T03:00:11","slug":"released-march-2023-exchange-server-security-updates","status":"publish","type":"post","link":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/","title":{"rendered":"Released: March 2023 Exchange Server Security Updates"},"content":{"rendered":"<div>\n<p>Microsoft has released Security Updates (SUs) for vulnerabilities found in:<\/p>\n<ul>\n<li>Exchange Server 2013<\/li>\n<li>Exchange Server 2016<\/li>\n<li>Exchange Server 2019<\/li>\n<\/ul>\n<p style=\"background: #F0F0F0; padding: .5em; margin: 1em 0 1em 0;\">SUs are <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/new-exchange-server-security-update-and-hotfix-packaging\/ba-p\/3301819\" target=\"_blank\" rel=\"noopener\">available<\/a> in a self-extracting auto-elevating .exe package, as well as the original update packages (.msp files), which can be downloaded from the <a href=\"https:\/\/www.catalog.update.microsoft.com\/Home.aspx\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Update Catalog<\/a>.<\/p>\n<p>SUs are available for the following specific versions of Exchange Server:<\/p>\n<ul>\n<li>Exchange Server 2013\u00a0<a href=\"https:\/\/www.microsoft.com\/download\/details.aspx?familyID=31b4713d-6c52-4ed4-a140-288608a3693d\" target=\"_blank\" rel=\"noopener noreferrer\">CU23<\/a>\u00a0(note that support and availability of SUs end on\u00a0<a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/exchange-server-2013-end-of-support-reminder\/ba-p\/3549596\" target=\"_blank\" rel=\"noopener\">April 11, 2023<\/a>)<\/li>\n<li>Exchange Server 2016\u00a0<a href=\"https:\/\/www.microsoft.com\/download\/details.aspx?familyID=6a698863-565b-4194-9647-07dd169c051f\" target=\"_blank\" rel=\"noopener noreferrer\">CU23<\/a><\/li>\n<li>Exchange Server 2019\u00a0<a href=\"https:\/\/www.microsoft.com\/download\/details.aspx?familyID=0b09e9ba-6921-4334-866f-19915eb8ec8a\" target=\"_blank\" rel=\"noopener noreferrer\">CU11<\/a>\u00a0and\u00a0<a href=\"https:\/\/www.microsoft.com\/download\/details.aspx?familyID=8d6cc411-a684-4733-8d70-05b19190c7ed\" target=\"_blank\" rel=\"noopener noreferrer\">CU12<\/a>\u00a0<\/li>\n<\/ul>\n<p>The March 2023 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft\u2019s internal processes. Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment.<\/p>\n<p>These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed in these SUs and do not need to take any action other than updating Exchange servers in their environment, and if applicable, installing the security update for Outlook on Windows described below.<\/p>\n<p>More details about specific CVEs can be found in the <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/\" target=\"_blank\" rel=\"noopener noreferrer\">Security Update Guide<\/a> (filter on Exchange Server under Product Family).<\/p>\n<h1 id=\"toc-hId--1962037775\"><span id=\"awareness-outlook-client-update-for-cve-2023-23397-released\"><font size=\"5\">Awareness: Outlook client update for CVE-2023-23397 released<\/font><\/span><\/h1>\n<p>There is a critical security update for Microsoft Outlook for Windows that is required to address <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-23397\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2023-23397<\/a>. To address this CVE, you must install the Outlook security update, regardless of where your mail is hosted (e.g., Exchange Online, Exchange Server, some other platform).\u00a0<\/p>\n<p>But if your mailboxes are in Exchange Online or on Exchange Server, after installing the Outlook update, you can use a <a href=\"https:\/\/aka.ms\/CVE-2023-23397ScriptDoc\" target=\"_blank\" rel=\"noopener noreferrer\">script we created<\/a> to see if any of your users have been targeted using the Outlook vulnerability. The script will tell you if any users have been targeted by potentially malicious messages and allow you to modify or delete those messages if any are found.<\/p>\n<p>The script will take some time to run, so we recommend prioritizing user mailboxes that are of higher value to attackers (e.g., executives, senior leadership, admins, etc.).<\/p>\n<h1 id=\"toc-hId-525475058\"><span id=\"update-installation\">Update installation<\/span><\/h1>\n<p>The following update paths are available:<\/p>\n<p><span class=\"lia-inline-image-display-wrapper lia-image-align-center\" image-alt=\"MAR2023SUpath.jpg\" style=\"width: 999px;\"><img decoding=\"async\" src=\"https:\/\/techcommunity.microsoft.com\/t5\/image\/serverpage\/image-id\/449309i641876791ACC299F\/image-size\/large?v=v2&amp;px=999\" role=\"button\" title=\"MAR2023SUpath.jpg\" alt=\"MAR2023SUpath.jpg\"><\/span><\/p>\n<ul>\n<li>Install the latest CU. Use the <a href=\"https:\/\/aka.ms\/ExchangeUpdateWizard\" target=\"_blank\" rel=\"noopener noreferrer\">Exchange Update Wizard<\/a> to choose your current CU and your target CU to get directions.<\/li>\n<li>Inventory your Exchange Servers to determine which updates are needed using the <a href=\"https:\/\/aka.ms\/ExchangeHealthChecker\" target=\"_blank\" rel=\"noopener noreferrer\">Exchange Server Health Checker<\/a>. Running this will tell you if any of your Exchange Servers are behind on updates (CUs, SUs) and if manual actions are needed.<\/li>\n<li>Always re-run Health Checker after you install an SU to see if any further actions are needed.<\/li>\n<li>If you encounter errors during or after installation of Exchange Server, run the <a href=\"https:\/\/aka.ms\/ExSetupAssist\" target=\"_blank\" rel=\"noopener noreferrer\">SetupAssist script<\/a>. If something does not work properly after updates, see <a href=\"https:\/\/aka.ms\/ExchangeFAQ\" target=\"_blank\" rel=\"noopener noreferrer\">Repair failed installations of Exchange Cumulative and Security updates<\/a>.<\/li>\n<\/ul>\n<h2 id=\"toc-hId-1216036532\"><span id=\"known-issues-with-this-release\">Known issues with this release<\/span><\/h2>\n<ul>\n<li>There are no known issues with this release<\/li>\n<\/ul>\n<h2 id=\"toc-hId--591417931\"><span id=\"issues-resolved-in-this-release\">Issues resolved in this release<\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/support.microsoft.com\/topic\/ews-web-application-pool-stops-after-the-february-2023-security-update-is-installed-f7ead47c-2303-4132-963e-b66548017340\" target=\"_blank\" rel=\"noopener noreferrer\">EWS web application pool stops after the February 2023 Security Update is<\/a> installed \u2013 if you have implemented the workaround in the KB article, you should remove the workaround once the March SU is installed (see the KB article for instructions). Running Health Checker will remind you of the need to remove the workaround.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/topic\/exchange-toolbox-and-queue-viewer-fails-after-certificate-signing-of-powershell-serialization-payload-is-enabled-7a1bff2d-614f-4fa0-bab1-ea6c25dae047\" target=\"_blank\" rel=\"noopener noreferrer\">Exchange Toolbox and Queue Viewer fails after Certificate Signing of PowerShell Serialization Payload is enabled<\/a>\u00a0&#8211; this issue has been resolved for servers running the Mailbox role, but this still occurs on servers and workstations that have only the Management Tools role installed.<\/li>\n<li>This release unblocks customers who can&#8217;t enable Extended Protection (EP) because they are using a Retention Policy with Retention Tags that perform Move-to-Archive actions. Note: if you worked around this problem using the <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/an-update-to-the-exchange-server-extended-protection-script-is\/ba-p\/3628801\" target=\"_blank\" rel=\"noopener\">updated Exchange Server Extended Protection script<\/a>, you should roll back the applied IP restrictions after installing this SU by following the <a href=\"https:\/\/microsoft.github.io\/CSS-Exchange\/Security\/Extended-Protection\/#rolling-back-ip-restriction-settings\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">script documentation<\/a>.<\/li>\n<\/ul>\n<h1 id=\"toc-hId--601921035\"><span id=\"faqs\">FAQs<\/span><\/h1>\n<p><strong><em>Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?<\/em><\/strong><br \/>Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing the March 2023 SU, you should re-run the Hybrid Configuration Wizard.<\/p>\n<p><strong><em>The last SU we installed is a few months old. Do we need to install all SUs in order, to install the latest one?<\/em><\/strong><br \/>SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs in sequential order; simply install the latest SU. Please see <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/why-exchange-server-updates-matter\/ba-p\/2280770\" target=\"_blank\" rel=\"noopener\">this blog post<\/a> for more information.<\/p>\n<p><strong><em>Do we need to install SUs on all Exchange Servers within our organization? What about \u2018Management Tools only\u2019 <\/em><\/strong><strong><em>machines?<br \/><\/em><\/strong>Our recommendation is to install SUs on <u>all<\/u> Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers.<\/p>\n<p>This post might receive future updates; they will be listed here (if available).<\/p>\n<p><font color=\"#CF3600\">&#8211;The Exchange Server Team<\/font><\/p>\n<\/div>\n<p><a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/released-march-2023-exchange-server-security-updates\/ba-p\/3764224\">Read full article (Microsoft Exchange Blog)<\/a><\/p>\n<p>All content and images belong to their respected owners, this article is curated for informational purposes only.<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server 2013 Exchange Server 2016 Exchange Server&hellip;\n","protected":false},"author":2,"featured_media":2564,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_appearance_grid":"","csco_page_load_nextpost":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"footnotes":""},"categories":[15],"tags":[66,67,68],"coauthors":[48],"class_list":["post-4094","post","type-post","status-publish","format-standard","has-post-thumbnail","category-microsoft-exchange-server","tag-microsoft","tag-released","tag-security","cs-entry","cs-video-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Released: March 2023 Exchange Server Security Updates | Sebae Networks<\/title>\n<meta name=\"description\" content=\"View Released: March 2023 Exchange Server Security Updates for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Released: March 2023 Exchange Server Security Updates | Sebae Networks\" \/>\n<meta property=\"og:description\" content=\"View Released: March 2023 Exchange Server Security Updates for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/\" \/>\n<meta property=\"og:site_name\" content=\"Sebae Networks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sebaenetworks\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-15T03:00:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/techcommunity.microsoft.com\/t5\/image\/serverpage\/image-id\/449309i641876791ACC299F\/image-size\/large?v=v2&amp;px=999\" \/>\n<meta name=\"author\" content=\"James Dean\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:site\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Dean\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Released: March 2023 Exchange Server Security Updates | Sebae Networks","description":"View Released: March 2023 Exchange Server Security Updates for free, here at Sebae. Discover more great posts on our website.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/","og_locale":"en_GB","og_type":"article","og_title":"Released: March 2023 Exchange Server Security Updates | Sebae Networks","og_description":"View Released: March 2023 Exchange Server Security Updates for free, here at Sebae. Discover more great posts on our website.","og_url":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/","og_site_name":"Sebae Networks","article_publisher":"https:\/\/www.facebook.com\/sebaenetworks","article_published_time":"2023-03-15T03:00:11+00:00","og_image":[{"url":"https:\/\/techcommunity.microsoft.com\/t5\/image\/serverpage\/image-id\/449309i641876791ACC299F\/image-size\/large?v=v2&amp;px=999","type":"","width":"","height":""}],"author":"James Dean","twitter_card":"summary_large_image","twitter_creator":"@sebaenetworks","twitter_site":"@sebaenetworks","twitter_misc":{"Written by":"James Dean","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#article","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/"},"author":{"name":"James Dean","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f"},"headline":"Released: March 2023 Exchange Server Security Updates","datePublished":"2023-03-15T03:00:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/"},"wordCount":834,"commentCount":0,"publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/exchange-server-header.png","keywords":["Microsoft","released","security"],"articleSection":["Microsoft Exchange Server"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/","url":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/","name":"Released: March 2023 Exchange Server Security Updates | Sebae Networks","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#primaryimage"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/exchange-server-header.png","datePublished":"2023-03-15T03:00:11+00:00","description":"View Released: March 2023 Exchange Server Security Updates for free, here at Sebae. Discover more great posts on our website.","breadcrumb":{"@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#primaryimage","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/exchange-server-header.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/exchange-server-header.png","width":1920,"height":1080,"caption":"exchange server header"},{"@type":"BreadcrumbList","@id":"https:\/\/www.sebae.net\/blog\/released-march-2023-exchange-server-security-updates\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sebae.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Released: March 2023 Exchange Server Security Updates"}]},{"@type":"WebSite","@id":"https:\/\/www.sebae.net\/blog\/#website","url":"https:\/\/www.sebae.net\/blog\/","name":"Sebae Networks","description":"Tech Tips, News, Tutorials &amp; Advice","publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sebae.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.sebae.net\/blog\/#organization","name":"Sebae","url":"https:\/\/www.sebae.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","width":512,"height":512,"caption":"Sebae"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/sebaenetworks","https:\/\/x.com\/sebaenetworks"]},{"@type":"Person","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f","name":"James Dean","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg72371c27260698ee55141397050ef40a","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","caption":"James Dean"},"sameAs":["https:\/\/www.sebae.net"],"url":"https:\/\/www.sebae.net\/blog\/author\/jdean\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/comments?post=4094"}],"version-history":[{"count":0,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4094\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media\/2564"}],"wp:attachment":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media?parent=4094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/categories?post=4094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/tags?post=4094"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/coauthors?post=4094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}