CVE-2023-36777: Microsoft Exchange Server information disclosure via untrusted deserialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (5.7) with high confidentiality impact but only adjacent-network, low-privilege access, and there is no KEV listing or documented exploitation despite a high EPSS score.

What it is

CVE-2023-36777 is an information disclosure flaw in Microsoft Exchange Server, mapped to CWE-502 (deserialization of untrusted data) alongside a no-information CWE entry. The record gives no detail on the vulnerable component, affected builds or the data exposed, so the exact mechanism cannot be confirmed from the supplied facts. It matters because Exchange holds mail, credentials and directory data, and the EPSS score places it in the top percentile of scored vulnerabilities.

Impact

An attacker with a low-privileged account on the adjacent network can read data they should not have access to; the CVSS vector rates confidentiality impact as high with no integrity or availability effect. No code execution or privilege escalation is indicated by the vector.

Attack surface

The vector AV:A/AC:L/PR:L/UI:N means the flaw is reached from an adjacent network position, requires low privileges, needs no user interaction and has low attack complexity. It is not remotely exploitable from the internet without first obtaining a foothold and credentials on the same network segment.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, so there is no confirmed in-the-wild exploitation. EPSS is 0.52011 (98.9th percentile), indicating high predicted likelihood, and the only references are Microsoft patch and advisory pages.

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory for CVE-2023-36777.
• Inventory Exchange servers and confirm which supported cumulative update and security update level each is running.
• Restrict network access to Exchange services so only trusted internal segments can reach them, reducing the adjacent-network path.
• Enforce least privilege on mail-enabled accounts and review accounts with elevated Exchange permissions.
• Monitor Microsoft guidance for any revision to the advisory, since the record is marked Modified.

Detection

• Review Exchange server logs for anomalous access to mailbox or directory data from low-privileged accounts on internal segments.
• Baseline normal internal clients that connect to Exchange and alert on new or unusual source hosts reaching Exchange endpoints.
• Correlate Exchange application and IIS logs for repeated read operations by a single low-privileged identity outside normal patterns.
• Track patch state of Exchange servers and alert on hosts still missing the update for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.