CVE-2023-21529
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-21529 is a HIGH-severity deserialization of untrusted data vulnerability in Microsoft Exchange Server that enables remote code execution, with a CVSS 3.1 score of 8.8. An authenticated attacker with any valid Exchange mailbox can send a crafted request that is processed by a vulnerable .NET deserializer and execute arbitrary code in the context of the Exchange service — typically SYSTEM. The flaw affects Microsoft Exchange Server 2013, 2016, and 2019 and was fixed in Microsoft's February 2023 Patch Tuesday. CISA added CVE-2023-21529 to the Known Exploited Vulnerabilities (KEV) catalog on April 13, 2026 after Microsoft documented abuse by the Storm-1175 threat cluster in Medusa ransomware operations, with a federal remediation deadline of April 27, 2026. With an EPSS score of 0.35017 (97.0th percentile), CVE-2023-21529 is among the most likely vulnerabilities to be actively exploited and should be treated as a priority patch for any still-on-premises Exchange environment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/(Technical Description)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2023-21529 is classified as CWE-502, where Microsoft Exchange Server reconstructs .NET objects from attacker-controlled serialized input without sufficient verification that the resulting object graph is valid and safe. An authenticated attacker who can reach the Exchange front-end is able to submit specially crafted serialized payloads that instantiate arbitrary classes or trigger dangerous gadget chains during deserialization, yielding remote code execution under the Exchange service account.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-21529 carries a CVSS 3.1 base score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which translates to a vulnerability that is remotely exploitable over the network against any reachable Exchange Server with low attack complexity, low privileges required (any authenticated mailbox user is sufficient), and no user interaction. The Scope is Unchanged, but the Confidentiality, Integrity, and Availability impacts are all HIGH because successful exploitation yields remote code execution in the Exchange service context, which in most deployments runs with SYSTEM or high-privileged domain-joined identities — an attacker can read or alter every mailbox, drop malware or web shells, pivot into Active Directory, and disrupt mail flow at will. Given Microsoft's documented observations of Storm-1175 leveraging web-facing Exchange assets in Medusa ransomware operations and an EPSS score of 35.02% (97.0th percentile), organizations running Exchange Server 2013, 2016, or 2019 on-premises should treat CVE-2023-21529 as a highly probable path to full tenant compromise.
Exploit Maturity
CVE-2023-21529 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-13 with a remediation deadline of 2026-04-27), and Microsoft's own threat intelligence team has publicly documented active abuse: the blog post Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations describes how the Storm-1175 cluster uses this deserialization vulnerability against internet-facing Exchange Server deployments as part of Medusa ransomware intrusions. The EPSS score of 35.02% (97.0th percentile) places CVE-2023-21529 in the top 3% of tracked vulnerabilities by exploitation likelihood. Although CISA's catalog entry does not currently flag the ransomware field as "Known," the Microsoft reporting clearly ties exploitation of this Exchange deserialization flaw to in-the-wild ransomware activity, and defenders should assume working exploit tooling is in broad circulation and plan patching and post-exploitation hunting accordingly.
Remediation
- Install the Microsoft February 2023 (or later) cumulative/security update immediately. Per CISA's required action for CVE-2023-21529, apply mitigations per vendor instructions and meet the BOD 22-01 remediation deadline of 2026-04-27. Follow the Microsoft Security Response Center advisory to install the fixed cumulative update for Exchange Server 2013, 2016, and 2019 and reboot impacted servers.
- Inventory all on-premises and hybrid Exchange servers. Confirm the build number of every Exchange Server 2013, 2016, and 2019 instance — including servers kept online solely for hybrid management — and plan patching (or decommissioning) for any that remain below the fixed build. Exchange 2013 has reached end of support, so migration away from that product is strongly recommended.
- Reduce Exchange front-end exposure. Because CVE-2023-21529 requires authentication but is reachable over the network, restrict Outlook on the Web, EWS, ECP, and Autodiscover endpoints to trusted IP ranges or VPN users, enforce Conditional Access and MFA on the Exchange front-end, and ensure no legacy protocols bypass MFA. This directly reduces the pool of principals who can submit the crafted deserialization payload.
- Hunt for Storm-1175 / Medusa ransomware indicators. Review the Microsoft threat intelligence write-up Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations, then search IIS logs, Exchange ECP/OWA logs, and EDR telemetry for suspicious process trees spawning from w3wp.exe (e.g., cmd.exe, powershell.exe, rundll32.exe), web shells dropped under Exchange virtual directories, and outbound connections to Medusa C2 infrastructure.
- Apply CWE-502 hardening beyond the patch. Where possible, remove unnecessary Exchange roles from internet exposure, keep antimalware scan interface (AMSI) enabled for IIS, ensure Exchange Emergency Mitigation Service (EEMS) is active to receive Microsoft's URL-rewrite mitigations, and require integrity checks on any future serialized transport.
- Plan a migration off on-premises Exchange where feasible. Given the ongoing frequency of high-severity deserialization and RCE findings in Exchange Server, evaluate migration to Exchange Online or a hardened hybrid model and decommission legacy Exchange servers promptly to reduce long-term CWE-502 exposure.
Technical Details
CVE-2023-21529 is a deserialization flaw in Microsoft Exchange Server 2013, 2016, and 2019 in which serialized .NET objects submitted by an authenticated user are reconstructed without adequate type restriction or integrity validation — the canonical CWE-502 pattern. Because Exchange accepts a serialized stream, materializes it into live objects, and invokes methods on those objects (for example during callback, property-setter, or constructor execution), an attacker can craft a payload that drives the .NET runtime through a known gadget chain and ultimately executes attacker-chosen code in the Exchange worker process (typically w3wp.exe or an Exchange service process running as NT AUTHORITY\SYSTEM). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the remote, low-complexity, authenticated-but-low-privileged nature of the vulnerability: any user able to submit an authenticated request to a vulnerable Exchange endpoint can trigger the code path, no user interaction is required, and a single successful request can yield full system compromise of the Exchange host — and, by extension, mailbox data integrity and confidentiality across the organization. The vulnerability was patched by Microsoft in the February 2023 Exchange Server security update referenced in the MSRC advisory.
Frequently Asked Questions
Is CVE-2023-21529 being actively exploited?
Yes. CVE-2023-21529 was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-13, and Microsoft's threat intelligence team has publicly documented exploitation by the Storm-1175 cluster in Medusa ransomware operations. The EPSS score of 35.02% (97.0th percentile) further indicates that active exploitation is highly likely.
What products are affected by CVE-2023-21529?
CVE-2023-21529 affects Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019 on-premises deployments. Exchange Online is not affected. Organizations should inventory every on-premises and hybrid Exchange server and confirm each has the February 2023 (or later) cumulative/security update installed.
How do I fix CVE-2023-21529?
Install the Microsoft security update for Exchange Server as documented in the MSRC advisory, restrict network exposure of Exchange front-end services, enforce MFA, and keep the Exchange Emergency Mitigation Service (EEMS) running to receive timely URL-rewrite mitigations. After patching, hunt for Storm-1175 and Medusa ransomware indicators in IIS, ECP/OWA, and EDR logs.
How severe is CVE-2023-21529?
CVE-2023-21529 is rated HIGH with a CVSS 3.1 base score of 8.8, and its 97.0th-percentile EPSS ranking places it among the most likely vulnerabilities to be exploited. Because successful exploitation yields remote code execution in the Exchange service context with HIGH confidentiality, integrity, and availability impact, unpatched Exchange 2013, 2016, and 2019 servers should be treated as a tenant-level business-critical risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.