> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/features-introduced-in-cortex-xdr-agent-7.6/microsoft-exchange-vulnerability-protection.md).

# Microsoft Exchange Vulnerability Protection

(Requires PTU 193-68672, or PTU 194-68995 and later)

Palo Alto Networks strongly recommends that you upgrade your operating system as soon as possible to address the vulnerability known as ProxyShell CVE-2021-34473.

The Cortex XDR agent provides additional coverage to identify known public POCs of the Microsoft Exchange SSRF Vulnerability associated with CVE-2021-34473 and ProxyShell. Two new behavioral threat protection alerts have been added to address these exploitation attempts:

* exchange\_autodiscover\_cve\_2021\_34473\_unpatched\_server—When using PTU 193-68672, this rule reports of unpatched endpoints that are attacked so you can proceed to patch them and mitigate the risk. Palo Alto Networks strongly recommends that you do not disable these notifications until your endpoint is patched. When using PTU 194-68995 or a later version, this rule blocks the attack on the endpoint and is named sync.exchange\_autodiscover\_cve\_2021\_34473\_unpatched\_server. The content version at time of event is very important for the distinction of a reported only or prevented attack.
* exchange\_autodiscover\_cve\_2021\_34473\_patched\_server—Reports of already patched endpoints where an exploitation attempt took place but failed since the machine is patched. This low severity alert is designed to inform you that your endpoint was targeted and requires no immediate action. You can disable this alert directly from Cortex XDR if you are no longer interested in receiving it.

To enable the Cortex XDR agent generate the alerts, follow these steps:

1. Ensure Behavioral Threat Protection (BTP) rules are enabled in your [Malware Security Profile](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md).
2. Verify the content version number on the endpoint is PTU 193-68672, or PTU 194-68995 and later. You can do so either from the [Endpoint Administration page](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints.md), or by running the cytool info query command on the endpoint. Otherwise, if the content number is different, perform check-in from the Cortex XDR agent console to retrieve latest PTU version.
3. Check the Cortex XDR agent version running on the endpoint. If the agent has already been upgraded to 7.4.2, you must restart the Cortex XDR agent so when the w3wp process is launched, the new policy is already in place and applied. Otherwise, if an earlier agent version is running on the endpoint, proceed to upgrade to the Cortex XDR agent to the 7.4.2 release and no agent restart is needed.
4. Restart Microsoft Internet Information Services (IIS) on the endpoint using the iisreset command on the endpoint. The Cortex XDR agent rules work only with the default installation paths for Exchange server and IIS
5. The new BTP rules are applied by default.
6. For your patched endpoints, you can stop receiving alerts by right-clicking an alert generated by the exchange\_autodiscover\_cve\_2021\_34473\_patched\_server rule in Cortex XDR and selecting Exclude Alert.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/features-introduced-in-cortex-xdr-agent-7.6/microsoft-exchange-vulnerability-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.