CVE-2023-36756: Microsoft Exchange Server deserialization flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.0 with full confidentiality, integrity and availability impact on a mail server, combined with a high EPSS percentile, warrants prompt patching despite the adjacent-network and low-privilege preconditions.

What it is

CVE-2023-36756 is a remote code execution vulnerability in Microsoft Exchange Server, classified by NVD under CWE-502 (deserialization of untrusted data) alongside a no-information CWE. The record is thin: it carries only a one-line description, no affected version list, and no technical detail on the vulnerable component, so the exact deserialization path cannot be confirmed from the supplied facts.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code in the context of the Exchange server process, giving full compromise of confidentiality, integrity and availability per the CVSS impact ratings. That level of access on a mail server typically exposes mailbox data and provides a foothold for lateral movement.

Attack surface

The CVSS vector AV:A/PR:L/UI:N indicates the attack is launched from an adjacent network position and requires low privileges, with no user interaction. It is not remotely exploitable over the internet per this vector, and the record does not state which Exchange interface or protocol is reached.

Exploitation

CISA KEV does not list this CVE and no ransomware usage is documented, but EPSS is high at roughly 0.49 probability (98.8th percentile), suggesting elevated likelihood of attempted exploitation. The only references are Microsoft's patch advisory, so no public exploit or in-the-wild activity is confirmed by this record.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2023-36756 as the first action.
• Restrict adjacent-network access to Exchange services and segment management or internal interfaces from general user networks.
• Enforce least privilege so that low-privileged accounts cannot reach the vulnerable component, since the vector requires only PR:L.
• Monitor Microsoft's advisory and any revision of this CVE for affected version details, which this record does not provide.

Detection

• Hunt for unexpected child processes spawned by Exchange server processes (w3wp.exe, MSExchange-related binaries), which can indicate post-exploitation code execution.
• Review Exchange logs for anomalous requests from internal or adjacent hosts, especially from low-privileged accounts, around the time of patching.
• Alert on deserialization-related errors or crashes in Exchange application and IIS logs that cluster by source host.
• Track EPSS and vendor advisories for this CVE to catch any change in exploitation status, since KEV currently shows no listing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.