Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Who is affected

How to fix it

Treat CVE-2023-21529 as an actively exploited Microsoft Exchange Server remote code execution risk. The local record and CISA KEV identify deserialization of untrusted data in Exchange Server, so exposed or internet-reachable Exchange servers should be patched with priority. Apply the Microsoft Security Update Guide fixes for the installed supported Exchange version and cumulative update level; do not rely on generic OS patching alone. If the server cannot be updated immediately, reduce external exposure, review mail and IIS logs, and plan replacement for unsupported Exchange builds.

1. Inventory every Microsoft Exchange Server deployment, including internet-facing Client Access, Outlook on the web, ECP, EWS, ActiveSync, hybrid, and management endpoints.
2. Check each server against the Microsoft Security Update Guide entry for CVE-2023-21529 and its installed Exchange cumulative update and security update level.
3. Install the applicable Exchange Server security update for the supported cumulative update branch, or first move to a supported CU and then apply the security update.
4. Restrict Exchange administrative interfaces such as ECP and remote PowerShell to trusted administrator networks or VPN where possible.
5. Review IIS, Exchange, ECP, PowerShell, and security logs for suspicious authenticated activity, unexpected mailbox access, web shell indicators, or new administrative assignments.
6. Run the Microsoft Exchange HealthChecker or equivalent inventory checks after patching to confirm supported build and security update status.
7. Rotate credentials and review mailbox delegation, application permissions, and OAuth/app registrations if compromise is suspected.
8. Retire or isolate unsupported Exchange servers that cannot receive the Microsoft security update.

Verify the fix

• Confirm every Exchange server reports a supported CU and the Microsoft security update that remediates CVE-2023-21529 or a later cumulative/security update.
• Confirm ECP, PowerShell, and other management endpoints are restricted to approved administrator paths.
• Confirm vulnerability management or Exchange inventory tooling no longer flags CVE-2023-21529.
• Review post-patch IIS and Exchange logs for continued exploit attempts or suspicious authenticated requests.
• Run a Fixnx scan against public mail hostnames to confirm visible Exchange exposure is understood.

Related categories

Trusted references

FAQ