CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Executive Summary

A deserialization of untrusted data vulnerability (CVE-2023-21529) in Microsoft Exchange Server allows an authenticated attacker to achieve remote code execution (RCE) on the target server. The flaw was patched in February 2023 but has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog in April 2026, indicating continued active exploitation against unpatched systems.

CVSS Score: 8.8 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exchange Server remains a high-value target for nation-state actors, ransomware operators, and financially motivated threat groups. Organizations running unpatched Exchange installations should treat this as an immediate remediation priority.

Vulnerability Overview

Affected Products

Technical Details

The Deserialization Root Cause

The vulnerability resides in the MultiValuedProperty class within Exchange Server's managed code. This class was permitted on the deserialization allow-list but lacked sufficient validation of untrusted data, enabling attackers to craft a malicious deserialization payload that bypasses standard sanitization mechanisms.

Attack Chain

1. Attacker obtains valid Exchange user credentials
   (via credential stuffing, phishing, or prior compromise)
2. Attacker sends a crafted HTTP request to an Exchange endpoint
   that triggers the MultiValuedProperty deserialization path
3. Malicious deserialization payload is processed without sanitization
4. Exchange Server deserializes attacker-controlled data
5. Code execution achieved with Exchange Server process privileges (SYSTEM)
6. Attacker can install webshells, exfiltrate email data, or pivot further

Why Authentication Doesn't Fully Mitigate Risk

While this vulnerability requires low-privilege authentication, Exchange credentials are routinely stolen through:

• Phishing campaigns targeting Exchange users
• Credential stuffing from leaked password databases
• Pass-the-hash / pass-the-ticket attacks from adjacent compromised hosts
• Password spraying against Outlook Web Access (OWA)

A single compromised Exchange account is sufficient to trigger this vulnerability, making it highly relevant in post-initial-access scenarios common to ransomware and espionage operations.

Impact Assessment

Recommendations

Immediate Patching

1. Apply KB5023038 — Install the February 2023 cumulative update for your Exchange version
2. Verify installation — Confirm the update applied via Get-ExchangeDiagnosticInfo
3. Prioritize internet-facing Exchange — OWA/EWS exposed to the internet is highest risk

Exchange Version Upgrade Paths

Exchange 2016 CU23 → Apply KB5023038 (SU6)
Exchange 2019 CU11 → Apply CU11 SU10
Exchange 2019 CU12 → Apply CU12 SU6
Exchange 2013      → Urgent: Exchange 2013 reached end of support April 2023

Hardening Recommendations

1. Restrict OWA access by IP if external access is not required
2. Enable Extended Protection for Authentication (EPA) on all Exchange virtual directories
3. Implement MFA on all Exchange/Outlook accounts — reduces credential abuse risk
4. Monitor Exchange IIS logs for anomalous POST requests to EWS/OWA endpoints
5. Deploy AMSI integration — Exchange 2016/2019 supports AMSI for scanning scripts

Detection Indicators

Post-Remediation Checklist

1. Confirm patch version — Run Get-ExchangeDiagnosticInfo -Server <name> -Process EdgeTransport -Component ResourceThrottling
2. Audit IIS logs for suspicious activity before patch date
3. Scan Exchange directories for unauthorized .aspx webshells
4. Review authentication logs for anomalous access patterns
5. Rotate service account passwords associated with Exchange
6. Check for unauthorized inbox rules or mail forwarding rules across mailboxes
7. Enable and review audit logging for all Exchange administrator actions

References

• NIST NVD — CVE-2023-21529
• Microsoft MSRC — CVE-2023-21529
• Microsoft KB5023038 Security Update
• CISA Known Exploited Vulnerabilities Catalog