“According to Microsoft, the issue exists because Exchange Server 2019 did not have NTLM credential relay protection, or Extended Protection for Authentication (EPA), enabled by default.”
CVE-2024-21410 scores 9.8 and is already exploited. Shadowserver counts more than 28,000 exposed Exchange servers vulnerable and another 68,000 possibly so, with Germany leading at 25,000. The fix was a protection Microsoft had shipped switched off. Customers paid for Exchange 2019 and got the security as an opt-in.