CVE-2023-21529: Microsoft Exchange Server deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is remotely reachable, rated CVSS 8.8, listed in CISA KEV with known ransomware use, and has a 99th-percentile EPSS score, making it an urgent patch target.

What it is

CVE-2023-21529 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Exchange Server that allows remote code execution. It carries a CVSS 3.1 score of 8.8 (HIGH) and is listed in CISA's Known Exploited Vulnerabilities catalog, with a vendor patch available. Because Exchange is typically internet-facing and the flaw is remotely reachable, it is a high-value target for both initial access and post-compromise activity.

Impact

A successful attacker can execute arbitrary code on the Exchange server, gaining control of the host and potentially the mail environment and its data. CISA's KEV entry notes known ransomware campaign use, so impact can extend to enterprise-wide encryption and extortion.

Attack surface

The CVSS vector AV:N/AC:L/PR:L/UI:N indicates the flaw is reachable over the network with low attack complexity and no user interaction, but requires low-privileged authentication. The record does not specify the exact Exchange endpoint or protocol, so the precise reachable interface cannot be confirmed from the supplied data.

Exploitation

CISA added CVE-2023-21529 to the KEV catalog with a due date of 2026-04-27 and flags known ransomware campaign use; EPSS gives a 30-day exploitation probability of 0.62104 (99.1st percentile). A Microsoft security blog reference ties it to Storm-1175 activity against web-facing assets in Medusa ransomware operations.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2023-21529 as the first action.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• Restrict network exposure of Exchange endpoints to trusted sources and enforce strong authentication to reduce the low-privileged access the vector requires.
• Monitor for and hunt post-exploitation activity consistent with ransomware staging, given the KEV ransomware flag.
• Verify Exchange build levels across all servers and prioritize any that remain unpatched.

Detection

• Hunt for suspicious w3wp.exe or Exchange worker process spawning of cmd.exe, powershell.exe or other unexpected child processes.
• Monitor Exchange IIS logs for anomalous requests to web-facing Exchange endpoints, especially from hosts that later perform lateral movement.
• Alert on deserialization-related crash or error patterns in Exchange application logs that precede code execution attempts.
• Correlate Exchange server activity with known Storm-1175 or Medusa ransomware indicators referenced in the Microsoft security blog.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.