CISA Issues Emergency Directive for Microsoft Exchange OWA Zero-Day (cisa.gov)

• CISA emergency directive mandates patching of Microsoft Exchange OWA zero-day
• Active exploitation of the vulnerability before patch release
• Federal agencies must comply within 14 days or implement mitigations

"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive addressing a zero-day vulnerability in Microsoft Exchange Online Web Access (OWA). The vulnerability is actively exploited, posing significant risk to federal and private sector networks. The directive mandates federal agencies to apply patches or implement mitigations within 14 days. This exploit underscores ongoing risks to digital infrastructure and the need for swift patching. While the directive is U.S.-focused, the global use of Microsoft Exchange means international implications are likely. Organizations are advised to follow CISA guidance to prevent data breaches and service disruptions."