Microsoft Exchange Server CVE-2023-21529

Exploitation requires network reachability to an Exchange Server 2013 CU23, 2016 CU23, or 2019 CU11/CU12 deployment and possession of at least low-privilege valid credentials on that Exchange organization (CVSS PR:L) - typically any mailbox-enabled domain user account is sufficient, since the vulnerable deserialization path is exposed to authenticated Exchange services. No user interaction is required (UI:N), attack complexity is low (AC:L), and no special non-default configuration is needed beyond running an affected CU. The principal limiting factor is the authentication requirement: pre-auth opportunistic scanning cannot reach the bug, so attackers must first acquire or coerce a single valid credential, which is a routine step for ransomware and state-sponsored operators but does exclude purely anonymous internet attackers.

This vulnerability should be treated as a top-priority patching target. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows network-reachable, low-complexity exploitation requiring only low-privilege authentication and no user interaction, with high impact across all three CIA pillars. The signals reinforce each other rather than conflict: CISA KEV listing confirms in-the-wild exploitation, public POC code lowers the barrier to attack, the 97th-percentile EPSS score (36.68%) indicates very high probability of near-term exploitation activity, and a vendor patch is available - meaning unpatched servers face an acute and quantified risk rather than a theoretical one. The only caveat to weigh is the PR:L requirement: an attacker must first hold valid credentials (commonly any mailbox-enabled user), which slightly bounds the population of pre-auth opportunistic attackers but does little to slow credential-stuffing or post-phishing operators.

An attacker obtains low-privilege Exchange credentials - for example through phishing, password spray, or reuse from a prior breach - and authenticates to an externally reachable Exchange endpoint such as Outlook Web Access or Exchange Web Services. They then submit a crafted request containing a malicious serialized object that triggers the deserialization flaw, causing the Exchange process to instantiate an attacker-controlled gadget chain and execute commands in the context of the Exchange service account. Because publicly available exploit code exists and the vulnerability is confirmed actively exploited (CISA KEV), this scenario is operationally realistic today rather than theoretical.