CVE-2023-36745: Microsoft Exchange Server deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.0 with high EPSS (0.79) and code execution on a critical mail server, though the adjacent-network and low-privilege requirements reduce exposure compared with an unauthenticated remote flaw.

What it is

CVE-2023-36745 is a remote code execution flaw in Microsoft Exchange Server, classified by NVD under CWE-502 (deserialization of untrusted data) with an additional no-information CWE entry. The record gives only a one-line description, so the specific vulnerable component and code path are not stated. It matters because successful exploitation yields code execution on an Exchange server, a high-value target for mail access and lateral movement.

Impact

An attacker with a valid low-privileged account can execute arbitrary code on the Exchange server, gaining the server's privileges over mail data and the host. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is AV:A (adjacent network) with PR:L (low privileges) and UI:N (no user interaction), so the flaw is reached from an adjacent network position and requires an authenticated low-privileged account, not a remote internet attacker. No user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.793 (99.6th percentile), indicating strong predicted exploitation activity. The only references are Microsoft patch advisories, so no public exploit or in-the-wild confirmation is provided in this record.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2023-36745.
• Restrict network access to Exchange services so untrusted adjacent-network hosts cannot reach them.
• Enforce least privilege and audit accounts with mailbox or Exchange administrative rights.
• Monitor for and remove unnecessary Exchange service accounts or delegated permissions that could supply the low-privileged access the vector requires.

Detection

• Monitor Exchange server processes for unexpected child processes or command execution, especially spawned by Exchange worker processes.
• Alert on deserialization-related errors or unusual object handling in Exchange logs and Windows event logs.
• Baseline and monitor authentication from adjacent network segments to Exchange endpoints for anomalous low-privileged accounts.
• Track Exchange patch level against the MSRC advisory to find unpatched servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.