The vulnerabilities lie in the Microsoft Client Access Service (CAS), which is commonly exposed to the public internet. This exposure has led to widespread exploitation by threat actors.