CVE-2023-36744: Microsoft Exchange Server remote code execution via untrusted deserialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.0 with high confidentiality, integrity and availability impact on an internet-facing platform, plus a 99th-percentile EPSS score, outweigh the absence of KEV listing and public exploit evidence.

What it is

CVE-2023-36744 is a remote code execution flaw in Microsoft Exchange Server, classified by NVD under CWE-502 (deserialization of untrusted data) alongside a no-information CWE entry. The record gives only a one-line description, so the specific vulnerable component and code path are not stated. It matters because Exchange is an internet-facing mail and collaboration platform, and successful exploitation yields code execution in the server context.

Impact

An attacker who can reach the vulnerable endpoint gains remote code execution on the Exchange server, with high confidentiality, integrity and availability impact per the CVSS vector. That level of access can expose mailbox data and provide a foothold for lateral movement inside the network.

Attack surface

The CVSS vector is AV:A (adjacent network), AC:L, PR:L, UI:N, meaning the attacker needs a low-privileged account and network adjacency rather than unauthenticated internet access. No user interaction is required. The record does not identify the specific Exchange service or endpoint involved.

Exploitation

CISA KEV does not list this CVE, and the only references are Microsoft's patch and vendor advisory pages, so there is no public evidence of in-the-wild exploitation in this record. EPSS is high at 0.62344 (99.1st percentile), indicating strong modeled likelihood of exploitation activity.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2023-36744.
• Restrict network access to Exchange services so only trusted internal hosts and required clients can reach them, reducing the adjacent-network exposure the vector assumes.
• Enforce least privilege on Exchange accounts and review which low-privileged users or service accounts can reach the affected interfaces.
• Monitor Microsoft guidance and re-check KEV and EPSS for changes in exploitation status.
• Keep Exchange cumulative updates current, since this flaw is fixed through the standard update channel.

Detection

• Monitor Exchange server processes for unexpected child processes or command execution originating from Exchange worker processes.
• Alert on anomalous authentication or access patterns from low-privileged accounts against Exchange endpoints, consistent with the PR:L vector.
• Review Exchange logs for unusual deserialization-related errors or crashes that may indicate exploitation attempts.
• Track network connections to Exchange services from unexpected adjacent hosts or segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.