What is CVE-2023-21529 and who needs to worry?
If your organisation runs Microsoft Exchange Server, you need to stop what you’re doing and read this. CVE-2023-21529 is a remote‑code‑execution flaw that lets an attacker who has a valid Exchange account run arbitrary code on the server. The CVSS score is 8.8 – that’s high. It was published on 14 February 2023 and has been confirmed exploited in the wild. Ransomware groups are already using it, and CISA has listed it in its Known Exploited Vulnerabilities catalogue as of 13 April 2026. If you manage Exchange, you are in the scope.
Related remediation guides
Other vulnerabilities in the same family or affecting the same products:
- CVE-2024-23897 – Jenkins CLI Path Traversal – What you need to know and fix now
- CVE-2024-4577 – Critical PHP CGI Command Injection
- CVE-2024-55591 – Immediate Action Guide for FortiOS and FortiProxy
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
How the vulnerability works
The NVD description tells us the problem is a deserialization of untrusted data. In plain English, Exchange takes data that comes from a client, turns it into an object in memory, and then trusts that object without checking its origin. An attacker who can log in can send a specially crafted payload that tricks the server into creating a malicious object. When the server later processes that object, the attacker’s code runs with the privileges of the Exchange service account. Because the service runs with high privileges on the host, the attacker can move laterally, install ransomware, or exfiltrate data.
The exact class of the vulnerable component has not been published, so we cannot point to a specific DLL or endpoint. What we do know is that the flaw lives in the code path that handles certain Exchange‑specific requests – typically those that involve mailbox‑related operations. The vulnerability is not remote unauthenticated; the attacker must already have a legitimate Exchange account. That makes it especially dangerous for organisations that expose Exchange to the internet for remote work, because credentials can be harvested elsewhere and then used here.
How to know if you’re exposed
First step: verify that Exchange Server is actually installed on the machine you’re checking. Run the following PowerShell command on any Exchange box:
Get-ExchangeServer | Format-List Name,AdminDisplayVersionThe output will show the product name and the build identifier that Microsoft uses for patches. Compare that identifier with the entries in the table below – the table is automatically populated from the NVD and lists which builds are vulnerable and which are patched. If your build appears in the vulnerable column, you are at risk.
Second step: check whether any recent security updates have been applied. Use the standard Windows update query:
Get-HotFix | Where-Object {$_.Description -match "Security"} | Sort-Object InstalledOn -DescendingLook for an entry that mentions Exchange Server and a date after the publication of the fix. If you cannot find such an entry, you probably haven’t applied the patch yet.
What Microsoft says you must do
Microsoft has released a security update that addresses the deserialization flaw. The vendor’s guidance is to apply the update as soon as possible. In the absence of a specific version number, the instruction is simply: “upgrade to the patched release for your branch.” That language matches the table below – the patched column shows the builds that contain the fix.
If you manage Exchange in a cloud‑hosted environment, CISA adds an extra requirement: follow the applicable BOD 22‑01 guidance for cloud services. In practice that means you must verify that the cloud provider has applied the Exchange security update, and that any custom configurations (such as hybrid deployments) are also covered.
Step‑by‑step remediation
1. Back up your Exchange configuration. Take a full backup of the server and any mailbox databases. This is standard practice before any major change.
2. Download the security update. Use the Microsoft Update Catalog or the built‑in Windows Update mechanism. Search for “Exchange Server security update February 2023”. Do not guess a KB number – the catalog will show the correct package for your environment.
3. Install the update. Run the installer on each Exchange server. The installer will stop the Exchange services, apply the binaries, and restart the services automatically. After installation, verify the build identifier again with the Get-ExchangeServer command.
4. Validate the patch. Re‑run the PowerShell command above and confirm that the build now appears in the patched column of the table. Also check the Windows Event Log for any errors during the installation.
5. Apply any additional hardening. CISA recommends disabling legacy authentication protocols if they are not required, and enforcing multi‑factor authentication for all Exchange accounts. Those steps reduce the chance that an attacker can obtain the credentials needed to exploit the vulnerability.
If a patch isn’t available for you
There are situations where the update cannot be applied – for example, an unsupported version that Microsoft no longer services, or a custom build that cannot be patched without breaking integrations. In those cases, CISA’s guidance is clear: either apply mitigations or discontinue use of the product.
Mitigations include:
- Restrict Exchange access to a VPN or Zero‑Trust network perimeter, so that only trusted IP ranges can reach the server.
- Enforce strict credential policies – long, random passwords and mandatory MFA.
- Disable any unused Exchange virtual directories that could be used to deliver the malicious payload.
- Monitor the server for suspicious activity, especially unexpected PowerShell commands or new processes running under the Exchange service account.
If you cannot meet those mitigation requirements, the safest path is to retire the Exchange deployment and migrate mailboxes to a supported platform – either a newer on‑premises version that receives updates, or a cloud service that is continuously patched.
What to watch for after remediation
Even after you install the patch, keep an eye on the following indicators of compromise:
- Unexpected logon events from accounts that normally never log on remotely.
- New scheduled tasks or services created under the SYSTEM or Exchange service account.
- Outbound connections to known ransomware command‑and‑control domains.
Set up alerting in your SIEM for any of these patterns. Early detection can stop an attacker who managed to bypass the patch or who is targeting another part of your network.
Summary
CVE-2023-21529 is a high‑severity, remotely exploitable flaw in Microsoft Exchange Server that has already been used in ransomware campaigns. The vulnerability stems from deserialization of untrusted data by an authenticated user. Microsoft has released a fix – apply it immediately. Use the PowerShell commands above to confirm your build, compare it with the table below, and verify that the patched release is installed. If you cannot patch, enforce network‑level restrictions, strong authentication, and continuous monitoring, or retire the product entirely. The clock is ticking – the longer the server stays unpatched, the greater the chance an attacker will turn a stolen credential into a ransomware infection.
Affected versions
NVD has not published machine-readable version ranges for CVE-2023-21529 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
