CVE-2023-36035: Microsoft Exchange Server spoofing flaw with deserialization risk

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.0 high severity with very high EPSS probability, though the record lacks exploit and KEV confirmation.

What it is

CVE-2023-36035 is a spoofing vulnerability in Microsoft Exchange Server, with the record also mapping it to CWE-502 (deserialization of untrusted data). The description is thin, so the exact spoofing mechanism is not stated, but the CVSS vector indicates high confidentiality, integrity and availability impact from an adjacent network position.

Impact

An attacker with low privileges on an adjacent network could spoof Exchange Server content or identities and potentially achieve high impact to confidentiality, integrity and availability. The record does not specify what is spoofed or what data is exposed.

Attack surface

Reached over an adjacent network (AV:A) with low privileges required (PR:L) and no user interaction (UI:N). No remote unauthenticated path is described in the record.

Exploitation

Not listed in CISA KEV and no ransomware use documented. EPSS is very high (0.86588, 99.7th percentile), suggesting elevated likelihood of exploitation, but the record contains no public exploit reference.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory.
• Restrict network access to Exchange services so only trusted adjacent hosts can reach them.
• Enforce least privilege on Exchange accounts and service identities.
• Monitor for anomalous Exchange authentication and deserialization-related activity.
• Review Exchange server logs for spoofing indicators after patching.

Detection

• Hunt for unusual Exchange authentication events from adjacent network segments.
• Monitor for deserialization-related errors or unexpected process behavior on Exchange servers.
• Alert on Exchange log entries indicating spoofed sender or identity anomalies.
• Correlate Exchange access with known trusted host lists and flag outliers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.