Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 14, 2023 · Catalog

   Detected

   Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

2. Apr 13, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Apr 27, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Aug 19, 2026 · Catalog

   Updated

   Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

Affected

• cpe microsoft/exchange server2013
• cpe microsoft/exchange server2016
• cpe microsoft/exchange server2019
• vendor Microsoft Exchange Serverversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-21529

  Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-21529

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-21529

  30-day exploitation probability 59.3%

  first.org
• NIST NVDVulnerability recordCVE-2023-21529

  Microsoft Exchange Server Remote Code Execution Vulnerability

  nvd.nist.gov

References

• CISA note · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Technical Description · microsoft.com