All vulnerabilities
CVE-2023-21529

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange ServerApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 13 Apr 2026. Known ransomware useCISA KEV
Exploit odds (EPSS)59.3%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.00.1497.047Also 15.01.2507.021, 15.02.0986.041 and 1 moreCVE List
Federal deadline27 Apr 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 15.00.1497.047Microsoft Exchange Server 2013 Cumulative Update 23CVE List
  • 15.01.2507.021Microsoft Exchange Server 2016 Cumulative Update 23CVE List
  • 15.02.0986.041Microsoft Exchange Server 2019 Cumulative Update 11CVE List
  • 15.02.1118.025Microsoft Exchange Server 2019 Cumulative Update 12CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 14 Feb 2023, 19:33 UTCPublishedCVE List
  2. 13 Apr 2026Added to CISA KEVCISA KEV

Description

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

Text from CVE List

Affected versions 4

  • Microsoft Exchange Server 2013 Cumulative Update 23affected: 15.00.0 before 15.00.1497.047CVE List
  • Microsoft Exchange Server 2016 Cumulative Update 23affected: 15.01.0 before 15.01.2507.021CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 11affected: 15.02.0 before 15.02.0986.041CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 12affected: 15.02.0 before 15.02.1118.025CVE List

References 4