It's October 2018, and Exchange can be pwned by an 8 year-old... bug
https://www.theregister.co.uk/2018/10/09/october_patch_tuesday/
Microsoft has released the October edition of its monthly security update, addressing a total of 49 CVE-listed bugs.
Among the 49 fixes were three issues that have already been publicly disclosed and a fourth that was being targeted in the wild. On top of that, a remote code execution bug in Exchange Server is the resurfacing of a vulnerability first found in 2010.