Feb 2023: Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21529 Published on February 14, 2023
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Known Exploited Vulnerability
This Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
The following remediation steps are recommended / required by April 27, 2026: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2023-21529 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2023-21529
Want to know whenever a new CVE is published for Microsoft Exchange Server? stack.watch will email you.
Affected Versions
Microsoft Exchange Server 2019 Cumulative Update 12:- Version 15.02.0 and below 15.02.1118.025 is affected.
- Version 15.02.0 and below 15.02.0986.041 is affected.
- Version 15.00.0 and below 15.00.1497.047 is affected.
- Version 15.01.0 and below 15.01.2507.021 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.