A severe vulnerability is said to be exploited by a malicious state of a 0-day threat.

Source: HAFNIUM targeting Exchange Servers with 0-day exploits – Microsoft Security

A security checking tool for Exchange is available here:

Exchange Server Security Checking Tool on Github