Remote code execution in on-premises mail server

Summary

In some self-hosted mail and calendar servers, a web-service component allows remote code execution through deserialisation of untrusted data.

Impact

The server can be fully compromised; mailbox content can be read and domain privileges stolen.

Detection

Monitor for newly created files in the web-service directory and suspicious child processes spawned by the server process.