#exchange

Analysis · May 5, 2026 · The Field Notes Desk

Exchange's deserialization problem didn't start in 2023. It still isn't fixed.

A ransomware group picked up a three-year-old Exchange RCE because scanning at scale still finds unpatched servers. The bug isn't the story. The patching economics are.