Microsoft: Patch your Exchange servers, they're under attack

What attacker needs to risk burning a zero-day flaw when targets leave critical Exchange bugs unpatched for months?