Microsoft published new tracking guidance for CVE-2026-73570, an unauthenticated command-injection vulnerability affecting internet-facing mail servers. The advisory underscores a familiar but high-impact operational risk: exposed infrastructure can move quickly from vulnerability disclosure to exploitation, especially where patching and monitoring lag behind.
Administrators should treat the advisory as a prompt to identify every exposed mail-server instance, confirm the vendor’s affected-version guidance, and apply the recommended fixes or mitigations on an emergency basis where appropriate. Exposure management should include related management interfaces and any systems reachable through mail-server trust relationships.
Detection work is equally important. Review web, mail, authentication, and endpoint logs for unexpected command execution, suspicious child processes, anomalous administrative activity, and unusual outbound network connections. Preserve relevant evidence before making broad changes if compromise is suspected, and follow the organization’s incident-response process. Microsoft’s post provides the vendor’s current technical context and defensive guidance; teams should monitor it for updates as investigation and remediation information evolves.
Source: Microsoft Security Blog: Unauthenticated command injection on internet-facing mail servers.