CVE-2023-21529

Think of Microsoft Exchange Server as your business’s email “hub.” This CVE is a flaw that can let an attacker, after getting a low level of access, convince the server to run attacker code from the network—similar to tricking a locked office to run a malicious program instead of the real task.
Because it can lead to full control, attackers can then read, change, delete data, and install malware (including ransomware).

This matters if you run Microsoft Exchange Server using one of the specific cumulative update versions: Exchange Server 2013 Cumulative Update 23, Exchange Server 2016 Cumulative Update 23, or Exchange Server 2019 Cumulative Update 11 or 12.
It’s not “no-login” by default; the findings indicate authentication is required with low privileges, meaning someone who already has low-level access could trigger it remotely.
The real danger is highest when the Exchange server is reachable over the network and an attacker has already obtained low-privilege access (for example via stolen credentials or another compromise).

Red: this is actively used in ransomware campaigns, and CISA has included it in its KEV catalog. Attackers already know how to turn this into full control of Exchange systems, so delay directly increases your chance of compromise.
Because the required action has a CISA due date (2026-04-27), you should schedule the patch as a top priority rather than a routine maintenance item.

1. Confirm whether you’re affected (quick check)

   • Identify your Microsoft Exchange Server version and cumulative update level for each Exchange server in your environment.
   • Compare against the affected set:
     • Microsoft Exchange Server 2013 Cumulative Update 23
     • Microsoft Exchange Server 2016 Cumulative Update 23
     • Microsoft Exchange Server 2019 Cumulative Update 11
     • Microsoft Exchange Server 2019 Cumulative Update 12

2. Plan the remediation (patch path)

   • Use Microsoft’s update guidance for CVE-2023-21529.
   • Patch to the fixed versions that correspond exactly to your current CU level:
     • Exchange Server 2013 CU23 → fixed in 15.00.1497.047
     • Exchange Server 2016 CU23 → fixed in 15.01.2507.021
     • Exchange Server 2019 CU11 → fixed in 15.02.0986.041
     • Exchange Server 2019 CU12 → fixed in 15.02.1118.025

3. Execute the update safely

   • Follow your normal Exchange maintenance procedure (including pre-checks/backups per your standard change process).
   • Apply the update, then verify:
     • Mail flow is working
     • Exchange services are healthy
     • The installed build/patch level matches the fixed version.

4. If patching is delayed

   • Apply the mitigations per Microsoft’s vendor instructions for CVE-2023-21529.
   • CISA’s KEV indicates the required action can be either mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

5. What to monitor after remediation

   • Look for signs of compromise around the time of exploitation attempts (unexpected admin changes, suspicious service activity, unusual authentication patterns, and unexpected malware behavior).
   • Confirm no persistence mechanisms were installed before the patch.

6. Deadline

   • CISA remediation due date for KEV: 2026-04-27.

Severity and type: This is a Remote Code Execution issue (CWE-502) affecting Microsoft Exchange Server, with the capability for full takeover of the server once exploited.
Authentication and attack prerequisites: The findings indicate authenticated attackers with low privileges can trigger the remote code execution. There is no user interaction required.
Mechanism (high level): The attacker manipulates how the system loads untrusted data from memory or files so the server executes arbitrary code.
Real-world exploitation status: CISA KEV lists CVE-2023-21529 as exploited in ransomware campaigns (added 2026-04-13). When a vulnerability is in KEV, that indicates it is actively used rather than merely theoretical.
Exploit availability: No public exploit code is on record in the provided findings.
EPSS: A rising prediction is provided in the findings, but public exploit/KEV status is the dominant indicator for urgency here.
Patch availability: Fixed builds are provided for the specific affected cumulative updates listed in the findings, via Microsoft’s update guidance for CVE-2023-21529.