CVE-2023-36756

This is a flaw in an email server that can let an improperly authorized person run their own instructions on it. Think of it as someone with a staff key finding a way to reach the building’s control room, rather than being limited to the rooms their key should open.

This matters if you run Microsoft Exchange Server for company email. It is only a risk if an attacker has a valid login and can reach the server from a nearby network.

An attacker who has a valid login and nearby network access can use this flaw to take control of the affected email server, making this an amber-priority update. There is no confirmed public exploitation, no public exploit code on record, and it is not listed in CISA’s known-exploited catalog.

Confirm the Exchange cumulative update and installed build on each server. Apply the Microsoft security update that brings Exchange Server 2016 CU23 to 15.01.2507.032, Exchange Server 2019 CU13 to 15.02.1258.025, or Exchange Server 2019 CU12 to 15.02.1118.037; use the vendor guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36756. No CISA KEV remediation due date applies because this CVE is not in KEV. If patching is delayed, restrict Exchange access to trusted network segments and review accounts that can authenticate to the server; monitor for unexpected account use and unusual server activity after remediation.

CVE-2023-36756 is CVSS 8.0 High (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The reported weakness is CWE-502, unsafe deserialization, with an adjacent-network attack vector, low complexity, required privileges, and no user interaction. It is not listed in CISA KEV and no public exploit code is on record. EPSS predicts a 49.2% likelihood (99th percentile) and is rising; this is a prediction, not evidence of confirmed exploitation.