There are two possible workarounds to address this vulnerability:
1. If the whitelist through Global URL Filtering is not needed, administrators can disable it by following these steps:
On the ESA, navigate to Security Services > URL Filtering.
Click on Edit Global Settings and set Use a URL whitelist to None. This disables the global whitelist.
Commit the Changes.
2. If the whitelist through Global URL Filtering feature is needed, the same level of filtering can be achieved by implementing a single whitelist per Content Filter, after disabling the whitelist through Global URL Filtering, as described in step 1. Administrators can choose a specific URL Reputation range or set of URL Categories to apply the whitelist to via the Content Filter. The required steps are as follows:
On the ESA, navigate to Mail Policies > Incoming Content Filters
[Optionally] Create a new Content Filter by clicking Add Filter
Click on the desired Content Filter > Add Action > URL Reputation > Select Custom Range
Input the desired range
[Alternatively] Add Action > URL Categories > Add desired Categories set
Choose the desired whitelist
Click OK > Submit
Commit the Changes