Microsoft Exchange Zero-Days and SketchUp Vulnerabilities Expose Data Theft and RCE Risks

Four zero-day vulnerabilities in Microsoft Exchange have been disclosed by Trend Micro's Zero Day Initiative (ZDI), allowing attackers to remotely execute arbitrary code or access sensitive information. Despite Microsoft acknowledging the flaws, they deemed them not severe enough for immediate servicing, leading ZDI to publish the vulnerabilities to warn Exchange admins. The vulnerabilities require authentication for exploitation, reducing their severity rating, but cybercriminals have various methods to obtain Exchange credentials. ZDI recommends restricting interaction with Exchange apps and implementing multi-factor authentication as mitigation strategies.