Exchange 2013 HAFNIUM attack: based on these factors, is this server compromised?

According to my research, these vulnerabilities are used as part of an attack chain. The initial attack requires the ability to make an untrusted connection to Exchange server port 443. Patching Exchange Servers immediately is the best first step. Other temporary options can include protection by restricting untrusted connections, or by setting up a VPN to separate the Exchange server from external access. Using this mitigation will only protect against the initial portion of the attack; other portions of the attack chain can be triggered if an attacker already has access or can convince an administrator to run a malicious file.

And the security update release contains fixes for seven security vulnerabilities affecting Exchange Server. Of these, four vulnerabilities were known to have been used in limited, targeted attacks against on-premises Exchange servers.

In addition, the blog Web shell attacks continue to rise may be helpful to you.