Vulnerability record · CVE-2006-0027 · published 10 May 2006
CVE-2006-0027: Microsoft Exchange remote code execution via crafted vCal/iCal properties
Microsoft · Exchange Server
CVE-2006-0027 is an unspecified vulnerability in Microsoft Exchange Server that lets a remote attacker execute arbitrary code by sending an email message containing crafted vCal or iCal Calendar properties. The record gives no root-cause detail beyond the calendar-parsing path, but the network-reachable, no-authentication vector and the code-execution outcome make it a serious server-side flaw. It matters because a single crafted message can compromise the mail server itself.
Description
Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution on a mail server with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
CVE-2006-0027 is an unspecified vulnerability in Microsoft Exchange Server that lets a remote attacker execute arbitrary code by sending an email message containing crafted vCal or iCal Calendar properties. The record gives no root-cause detail beyond the calendar-parsing path, but the network-reachable, no-authentication vector and the code-execution outcome make it a serious server-side flaw. It matters because a single crafted message can compromise the mail server itself.
Impact
An attacker gains arbitrary code execution on the Exchange server, typically in the context of the service account, which can lead to full mail-store and host compromise. No confidentiality, integrity or availability sub-score is dominant in the CVSS vector; all three are partial.
Attack surface
Reached over the network by delivering an email with crafted vCal or iCal Calendar properties to the Exchange server; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. The description does not state whether a recipient must open or preview the message, so user interaction cannot be confirmed from the record.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high (0.787 probability, 99.6th percentile), suggesting elevated exploitation likelihood; reference tags show only patch, vendor and third-party advisory entries, with no public exploit or in-the-wild tag.
What to do
- Apply the Microsoft security update for MS06-019 (the vendor advisory is tagged Patch) as the first action.
- Follow the US-CERT TA06-129A and CERT/CC VU#303452 guidance referenced in the record.
- Restrict or filter inbound email carrying vCal/iCal calendar attachments at the mail gateway where operationally feasible.
- Limit the privileges of the Exchange service account to reduce the impact of successful code execution.
Detection
- Monitor Exchange server processes for unexpected child processes or command execution originating from mail-handling services.
- Inspect mail gateway and Exchange logs for inbound messages with vCal/iCal calendar properties from untrusted senders.
- Alert on crashes or abnormal restarts of Exchange store and transport services that coincide with calendar message delivery.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-0027 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-0027), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
