CVE Vulnerability Advisory Database

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Microsoft Exchange Server 2016 and 2019 environments where Cumulative Updates and Extended Protection are not enabled.

[Impact] Unauthenticated remote attackers can perform NTLM credential relay attacks to elevate privileges, gaining administrative access to Exchange servers and compromising mailboxes.

[Mitigation] Upgrade Exchange Server to the latest Cumulative Update (CU) and enforce the Extended Protection feature immediately.

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] An authenticated attacker can execute arbitrary commands with SYSTEM privileges and fully compromise the server by sending specially crafted serialized data

[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises environments.

[Impact] An authenticated attacker can leverage Remote PowerShell sessions to elevate privileges to SYSTEM, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft, and restrict unnecessary Remote PowerShell access.

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates

[Impact] Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges

[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments

[Impact] Authenticated attackers can exploit this SSRF vulnerability to access backend APIs, leading to Remote Code Execution (RCE) and complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] High-privileged remote attackers can execute arbitrary code and gain full system control over the Exchange Server

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access