CVE-2020-17144

Microsoft Exchange Server's CVE-2020-17144 allowed remote code execution via improper cmdlet argument validation, exploited in the wild starting January 2021.

The vulnerability enabled attackers to execute arbitrary code on Exchange servers without authentication, leading to widespread breaches and ransomware deployments. DIB organizations must ensure all Exchange servers are patched immediately, as unpatched instances remain high-value targets for supply-chain and data-breach attacks. This failure highlights the critical need for rigorous patch management and continuous vulnerability monitoring.

Shame score — A known, high-severity RCE flaw that remained unpatched for months, was actively exploited in the wild, and caused massive data breaches and ransomware infections across the globe.