CVE-2023-21529: Microsoft Exchange Server RCE Vulnerability Added to Known Exploited Vulnerabilities Catalog
Summary
CISA added CVE-2023-21529, a Microsoft Exchange Server remote code execution vulnerability, to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) and is attributed to CWE-502 (Deserialization of Untrusted Data). Exploitation is assessed as 'active' with total technical impact and no automatable exploitation vector. Affected versions span Exchange Server 2016 and 2019 across multiple build ranges. Federal agencies are subject to BOD 22-01 remediation requirements for KEV catalog entries.
What changed
CISA incorporated CVE-2023-21529 into the Known Exploited Vulnerabilities catalog. The CVE describes a remote code execution vulnerability in Microsoft Exchange Server stemming from unsafe deserialization, affecting multiple build ranges of Exchange Server 2016 and 2019. CISA's SSVC analysis classifies exploitation as 'active' with no automatable attack vector but total technical impact.
Organizations running affected Microsoft Exchange Server deployments face heightened remediation priority as KEV catalog inclusion subjects federal agencies to BOD 22-01 remediation timelines. Private sector entities managing critical infrastructure should similarly prioritize patching given confirmed active exploitation. The CVSS 8.8 score reflects significant potential impact across confidentiality, integrity, and availability. System administrators should immediately identify Exchange Server build versions and apply corresponding patches from Microsoft's security update guide.
What to do next
- Review and remediate CVE-2023-21529 per BOD 22-01 requirements
- Apply vendor patches to affected Microsoft Exchange Server versions or implement compensating controls
- Consult Microsoft MSRC advisory for specific patched build versions
Archived snapshot
Apr 14, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Required CVE Record Information
CNA: Microsoft Corporation
Description
Microsoft Exchange Server Remote Code Execution Vulnerability
CWE 1 Total
Learn more
- CWE-502: CWE-502: Deserialization of Untrusted Data
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.8 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected from 15.02.0 before 15.02.1118.025 Versions 1 Total
Default Status: unknown
affected
- affected from 15.02.0 before 15.02.0986.041 Versions 1 Total
Default Status: unknown
affected
- affected from 15.00.0 before 15.00.1497.047 Versions 1 Total
Default Status: unknown
affected
- affected from 15.01.0 before 15.01.2507.021
References 1 Total
CVE Program
Updated:
2024-08-02
This container includes required additional information provided by the CVE Program for this vulnerability.
References 1 Total
- msrc.microsoft.com: Microsoft Exchange Server Remote Code Execution Vulnerability vendor-advisory x_transferred
Authorized Data Publishers
CISA-ADP
Updated:
2026-04-14
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | total | 2.0.3 | 2023-02-15 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529 (2026-04-13)
Related changes
Get daily alerts for CISA Known Exploited Vulnerabilities (KEV)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CISA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.