CVE-2020-17143: Microsoft Exchange Server information disclosure flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though no KEV listing or confirmed exploit.

What it is

CVE-2020-17143 is an information disclosure vulnerability in Microsoft Exchange Server. The record gives only a one-line description and no CWE detail, so the exact mechanism is not stated. It matters because the CVSS vector rates confidentiality, integrity and availability impact as high, meaning the flaw can do more than leak data.

Impact

An attacker with a low-privileged account could read sensitive information and, per the CVSS vector, also affect integrity and availability of the Exchange service. The record does not specify what data is exposed.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction. It requires low privileges (PR:L), so an attacker needs some valid authenticated access, not full admin rights.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, so there is no confirmed in-the-wild exploitation in this record. EPSS is high at 0.70632 (99.4th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2020-17143 from the MSRC advisory as the first action.
• Confirm all Exchange servers, including edge and hybrid roles, are patched to the fixed build.
• Restrict and audit low-privileged mailbox and Exchange accounts to limit what an authenticated attacker can reach.
• Monitor Exchange servers for unusual data access or service disruption following the patch window.

Detection

• Review Exchange logs for anomalous access by low-privileged accounts to mailbox or configuration data.
• Alert on unexpected Exchange service restarts or availability drops that could indicate abuse.
• Correlate outbound data transfers from Exchange hosts with account activity for signs of exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.