CVE-2023-21529
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description
Microsoft Exchange Server Remote Code Execution Vulnerability
INFO
Published Date :
Feb. 14, 2023, 8:15 p.m.
Last Modified :
April 14, 2026, 2:44 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known Detected Apr 22, 2026
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Microsoft has released the following security updates to address this issue: -KB5023038
Public PoC/Exploit Available at Github
CVE-2023-21529 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-21529.
| URL | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 | Patch Vendor Advisory |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 | Patch Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529 | US Government Resource |
| https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/ | Technical Description |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-21529 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-21529
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
A Remote Code Execution (RCE) vulnerability impacting Microsoft Exchange Server CVE-2023-21529 POC
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-21529 vulnerability anywhere in the article.
-
CybersecurityNews
CISA Warns of Microsoft Exchange and Windows CLFS Vulnerabilities Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to organizations regarding two severe Microsoft vulnerabilities. On April 13, 2026, the agency officially added ... Read more
-
Daily CyberSecurity
CISA Adds 7 Fresh Exploits to KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding seven high-risk flaws that are currently being weaponized by maliciou ... Read more
-
The Hacker News
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitatio ... Read more
-
TheCyberThrone
CISA Adds Seven Vulnerabilities to KEV Catalog — April 13, 2026
CISA has expanded the Known Exploited Vulnerabilities catalog with seven new entries on April 13, 2026, based on evidence of active exploitation. The batch spans three vendors — Microsoft, Adobe, and ... Read more
-
The Register
Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum
Crooks are exploiting four Microsoft vulnerabilities - one patched 14 years ago and another tied to ransomware activity - according to America's lead cyber-defense agency, which on Monday gave federal ... Read more
-
The Hacker News
China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate "high-velocity" attacks and ... Read more
-
TheCyberThrone
The CyberThrone Most Exploited Vulnerabilities Top 10 – October 2024
Welcome to TheCyberThrone most exploited vulnerabilities review. This review is for the month of October 2024CVE-2024-21762: Fortinet FortiOS: Out-of-bounds WriteCVSS 3.1 score : 9.8 CISA KEV : Y ... Read more
The following table lists the changes that have been made to the
CVE-2023-21529 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Apr. 14, 2026
Action Type Old Value New Value Removed CWE NVD-CWE-noinfo Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529 Types: US Government Resource Added Reference Type CISA-ADP: https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/ Types: Technical Description -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 13, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529 Added Reference https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/ -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 -
CVE Modified by [email protected]
May. 29, 2024
Action Type Old Value New Value Added CWE Microsoft Corporation CWE-502 -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Feb. 22, 2023
Action Type Old Value New Value Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 Patch, Vendor Advisory Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:* *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*