- Exchange: Exchange Online only (EXO). All mailboxes migrated; no on-prem Exchange servers remain.
- deployment: cloud
- notes: flagship Layer-1 fact, makes any on-prem-only Exchange CVE (e.g. OWA frontend bugs) not-applicable
- Active Directory: on-prem, single forest, two domain controllers.
- version: Windows Server 2022, fully patched as of 2026-05-10
- exposure: internal only
- MacBook Pro: 8 units, macOS 15.4
- iPhone 17: 12 units, managed via MDM
- nginx: 1.25.3
- role: TLS-terminating reverse proxy
- deployment: bare metal, 2 nodes
- exposure: internet-facing (source: user-confirmed, 2026-05-20)
- cpe: cpe:2.3:a:nginx:nginx:1.25.3:::::::*
complete: true
- FortiGate 100F: FortiOS 7.4.3
- role: perimeter firewall
- exposure: internet-facing on WAN
- PostgreSQL: 16.3
- role: application database
- exposure: internal only
| Condition | value | last_verified | source | volatility | notes |
|---|---|---|---|---|---|
| RC4 allowed as Kerberos etype | no | 2026-05-01 | user-confirmed | stable | domain policy enforces AES only |
| OWA in use (on-prem) | no | 2026-05-15 | user-confirmed | stable | derived from EXO-only Exchange deployment in Layer 1 |
| Exchange Online build | 24.192.xx | 2026-05-07 | user-confirmed | volatile | cloud service, build changes frequently; re-confirm at next assessment that touches it |
| date | CVE | verdict | basis |
|---|---|---|---|
| 2026-05-18 | CVE-2026-XXXX | not affected | Exchange OWA frontend bug; all mailboxes EXO-only, on-prem OWA vector not present |
| 2026-05-21 | CVE-2026-YYYY | not affected | nginx HTTP/3 handler overflow; HTTP/3 not enabled on the proxy, vector not reachable |