CVE-2020-17144: Microsoft Exchange Server deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 8.4, confirmed KEV exploitation and a high EPSS percentile make this a high-priority patching target, though the PR:H and UI:R requirements lower it below critical.

What it is

CVE-2020-17144 is a remote code execution vulnerability in Microsoft Exchange Server caused by deserialization of untrusted data (CWE-502). It carries a CVSS 3.1 base score of 8.4 (High) and is listed in CISA's Known Exploited Vulnerabilities catalog, so it matters as a real-world target rather than a theoretical bug.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code on the Exchange server, with high impact to confidentiality, integrity and availability per the CVSS vector. Because the scope is changed (S:C), the compromise can extend beyond the vulnerable component.

Attack surface

The vector is network-reachable (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and user interaction (UI:R). This means an attacker needs an authenticated, privileged position plus a victim action, not an unauthenticated remote hit.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a remediation due date of 2022-05-03, confirming exploitation in the wild; EPSS gives a 30-day probability of 0.36514 (98.4th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft Exchange Server updates referenced in the MSRC advisory and update guide immediately.
• Verify patched build levels across all Exchange servers, including any previously missed or offline hosts.
• Restrict and audit privileged Exchange accounts, since exploitation requires high privileges.
• Reduce exposure of Exchange endpoints to untrusted networks and enforce MFA on privileged access.

Detection

• Hunt for Exchange server processes spawning unexpected child processes such as cmd.exe or PowerShell.
• Monitor for suspicious deserialization or web request patterns against Exchange endpoints from privileged accounts.
• Alert on post-exploitation activity from Exchange service accounts, including new files, scheduled tasks or web shells.
• Correlate Exchange logs with authentication events for high-privilege accounts around unusual request times.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.