CVE-2023-21707: Microsoft Exchange Server remote code execution via untrusted deserialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (0.8202) make this a serious Exchange RCE, though the required low privileges and absence of KEV listing keep it below critical.

What it is

CVE-2023-21707 is a remote code execution flaw in Microsoft Exchange Server, classified by NVD under CWE-502 (deserialization of untrusted data) with an accompanying no-information CWE. The record gives only a one-line description, so the specific vulnerable component, affected builds and root cause are not stated. It matters because Exchange is an internet-facing service and successful exploitation yields code execution in its context.

Impact

An authenticated attacker who can reach the vulnerable endpoint can execute arbitrary code on the Exchange server, with high impact to confidentiality, integrity and availability per the CVSS vector. That typically means control of mail data and a foothold on a server that often holds privileged directory relationships.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction (AC:L/UI:N), but it requires low privileges (PR:L), so the attacker needs at least a valid low-privileged account or session. The record does not identify the specific endpoint or protocol involved.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.8202 (99.6th percentile), indicating strong predicted likelihood of exploitation. The only references are Microsoft's patch and vendor advisory, with no public exploit or in-the-wild reporting cited in this record.

What to do

• Apply the Microsoft Exchange security update referenced in the MSRC advisory for CVE-2023-21707 as the first action.
• Confirm which Exchange cumulative update and security update level each server is on, since the record does not list affected versions.
• Restrict network exposure of Exchange endpoints (OWA, ECP, autodiscover, PowerShell) to trusted networks or a reverse proxy with authentication.
• Enforce least privilege and review accounts with mailbox or Exchange administrative rights, as exploitation requires low privileges.
• Monitor Microsoft advisories and CISA KEV for updated exploitation status before relaxing any controls.

Detection

• Hunt Exchange server logs (IIS, ECP/OWA, PowerShell) for anomalous requests or deserialization-related errors preceding unexpected child processes.
• Alert on w3wp.exe or Exchange service processes spawning cmd.exe, powershell.exe or other unusual children.
• Baseline and monitor new files, web shells or modified Exchange binaries in web-accessible directories.
• Correlate low-privileged mailbox account activity with server-side process creation or outbound connections from the Exchange host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.