Share This:

Cybersecurity Threat Advisory

Microsoft announced that a recently disclosed security flaw had been exploited just one day after it released fixes for the vulnerability. CVE-2024-21410, an Exchange Server vulnerability, with a CVSS score of 9.8, allows threat actors to escalate privileges of the affected Exchange Server. Read this Cybersecurity Threat Advisory to find out if you are at risk, and how to minimize your risk.

What is the threat?

CVE-2024-21410 can allow remote unauthenticated threat actors to escalate privileges in New Technology LAN Manager (NTLM) and execute relay attacks targeting vulnerable versions of Microsoft Exchange Server. Threat actors can force a network device, such as a server or domain controller, to authenticate against an NTLM relay under their control to impersonate the targeted devices and elevate their privileges.

Why is it noteworthy?

While specific details regarding the exploitation and the identity of the threat actors behind it are currently undisclosed, it’s worth noting the historical association with hacker groups such as APT28. These groups have a track record of exploiting vulnerabilities in Microsoft Outlook, particularly for staging NTLM relay attacks. Recently, they’ve been linked to NTLM relay attacks targeting high-value entities since at least April 2022. These attacks have focused on organizations spanning foreign affairs, energy, defense, transportation, labor, social welfare, finance, parenthood, and local city councils.

What is the exposure or risk?

This flaw presents an opportunity for attackers to conduct credential-leaking attacks against NTLM clients like Outlook. Microsoft warns that the leaked credentials can be relayed to an Exchange server. Successful exploitation can lead to the attacker assuming the victim client’s privileges and execute operations on the Exchange server.

What are the recommendations?

Barracuda MSP recommends the following actions to mitigate the impact of CVE-2024-21410:

  • Implement Exchange Server 2019 Cumulative Update 14 (CU14) which includes NTLM credentials relay protection to reduce risks from this vulnerability.
  • Use the ExchangeExtendedProtectionManagement PowerShell script for versions prior to Exchange Server 2019 to activate extended protection (EP).
  • Review Microsoft’s EP documentation to identify and address any potential issues. Conduct thorough assessments of the environment before enabling EP.


For more in-depth information about the recommendations, please visit the following links:

If you have any questions regarding this Cybersecurity Threat Advisory, please contact Barracuda XDR’s Security Operations Center.

Share This:
Zachary Beaudet

Posted by Zachary Beaudet

Zachary is a Cybersecurity Analyst at Barracuda MSP. He's a security expert, working on our Blue Team within our Security Operations Center. Zachary supports our XDR service delivery and is highly skilled at analyzing security events to detect cyber threats, helping keep our partners and their customers protected.

Leave a reply

Your email address will not be published. Required fields are marked *