Vulnerability record · CVE-2020-16875 · published 11 September 2020
CVE-2020-16875: Microsoft Exchange cmdlet argument validation RCE
Microsoft · Exchange Server
Microsoft Exchange Server fails to properly validate cmdlet arguments, allowing an authenticated user in a specific Exchange role to execute arbitrary code. The flaw is remotely reachable and runs code as the System user, making it a serious post-authentication escalation path on Exchange hosts.
Description
<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution as System on Exchange with public exploit references and very high EPSS, though it requires an authenticated privileged role and user interaction.
What it is
Microsoft Exchange Server fails to properly validate cmdlet arguments, allowing an authenticated user in a specific Exchange role to execute arbitrary code. The flaw is remotely reachable and runs code as the System user, making it a serious post-authentication escalation path on Exchange hosts.
Impact
An attacker with a compromised Exchange role account gains arbitrary code execution in the context of the System user, effectively full control of the Exchange server.
Attack surface
Reached over the network via Exchange cmdlet handling; the vector requires high privileges (PR:H) and user interaction (UI:R), so a valid Exchange role account and some user action are needed.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.474, ~98.8th percentile) and public exploit references exist, indicating active interest and available proof-of-concept code.
What to do
- Apply the Microsoft security update for CVE-2020-16875 immediately on all Exchange servers.
- Restrict and audit Exchange role assignments, removing unnecessary privileged roles from accounts.
- Enforce MFA and strong credential hygiene to reduce the risk of role account compromise.
- Monitor Exchange cmdlet activity for anomalous or unexpected argument patterns.
Detection
- Alert on Exchange cmdlet invocations with unusual or malformed arguments, especially DlpUtils/AddTenantDlpPolicy related activity.
- Monitor for child processes spawned by Exchange (w3wp.exe, powershell) that indicate code execution.
- Review Exchange role group membership changes and authentication from unusual sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution. | ExploitThird Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875 | PatchVendor Advisory |
| http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution. | ExploitThird Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875 | PatchVendor Advisory |
Track CVE-2020-16875 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-16875), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
