CVE-2023-36757

Businesses using the listed Microsoft Exchange Server updates should schedule the available security update soon to prevent an attacker from impersonating trusted communications or taking control of email services.

Executive summary

CWE-502 deserialization weakness in Microsoft Exchange Server, reachable from an adjacent network by an attacker with low privileges, with high potential confidentiality, integrity, and availability impact.

If affected, business impact

Email impersonation riskMailbox data exposureEmail data alterationMail service disruptionBusiness communication compromise

What to do now

Check whether your Microsoft Exchange Server is Exchange Server 2016 CU23 or Exchange Server 2019 CU12 or CU13, and record its current build number.
Update Exchange Server 2016 CU23 to build 15.01.2507.032.
Update Exchange Server 2019 CU12 to build 15.02.1118.037 or Exchange Server 2019 CU13 to build 15.02.1258.025.
Have IT confirm the update installed successfully and investigate unexpected mailbox, account, or mail-flow changes.

Patch / advisory Usually a quick update

What is it

This is a flaw in the software that runs business email. Think of it as a weakness in the mailroom’s verification process: someone with limited access nearby may be able to make harmful requests appear legitimate, potentially affecting messages and the email service itself.

Who is affected

This matters to you if you run Microsoft Exchange Server, particularly Exchange Server 2016 CU23 or Exchange Server 2019 CU12 or CU13. The attacker must already have low-level access and be able to reach the server from an adjacent network.

How urgent is it

An attacker with low-level access on an adjacent network can target affected email servers, so treat this as an urgent scheduled update. It is not listed in CISA’s catalog of vulnerabilities known to be exploited, and no public exploit code is recorded, which supports an amber rather than emergency response.

What to do — in detail

Confirm the installed Exchange cumulative update and build number, then compare it with the affected builds. For Exchange Server 2016 CU23, target 15.01.2507.032; for Exchange Server 2019 CU12, target 15.02.1118.037; and for Exchange Server 2019 CU13, target 15.02.1258.025.

Obtain the applicable vendor update through the Microsoft Security Response Center guidance, test it in the normal change process where possible, and verify the resulting build after installation. If patching must wait, limit access to the Exchange server from adjacent networks, review and restrict low-privilege accounts, and investigate unexpected mailbox, account, or mail-flow activity. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CVSS v3.1 is 8.0 (High): AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The reported weakness is CWE-502, with the public description identifying a Microsoft Exchange Server spoofing vulnerability; the findings do not provide a more specific vulnerable component or request format. No CISA KEV listing and no public exploit code are recorded. EPSS predicts a 36.9% likelihood (98th percentile), with a rising trend; this is predictive rather than confirmation of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:AAttack Vector

Adjacent

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-502 NVD-CWE-noinfo

Affected Products

Microsoft Corp

commercial·USaka microsoft, microsoft corporation

exchange serverOn-prem

Operating Systems / windows

Microsoft Exchange ServerOn-prem

Operating Systems

Microsoft Exchange Server 2016 Cumulative Update 23On-prem

Operating Systems

Microsoft Exchange Server 2019 Cumulative Update 12On-premWeb App

Enterprise Software / itsm-monitoring

Microsoft Exchange Server 2019 Cumulative Update 13On-premOS

Operating Systems / windows

Exploitability

Official Patch Available

Is your org exposed to CVE-2023-36757?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

3 techniques

Execution

Initial Access

View detailed technique mapping

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36757

msrc.microsoft.com

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36757

msrc.microsoft.com

https://www.cybersecurity-help.cz/vdb/SB2023091254

cybersecurity-help.cz

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2023-36757 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows