CVE-2023-21529

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 59.29%
EPSS Percentile: 99.12%
CISA KEV: YES — Known Exploited Vulnerability

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Feb-2023 03:15
Last Modified: 20-Aug-2026 00:18
EPSS Date: 2026-11-05
CWE: CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-04-13
Remediation Due: 2026-04-27
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

CNA Products / Version Status

Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 Source: CNA · [email protected]
Default status: unknown

15.00.0 ≤ version < 15.00.1497.047 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 Source: CNA · [email protected]
Default status: unknown

15.01.0 ≤ version < 15.01.2507.021 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft Exchange Server 2019 Cumulative Update 11 Source: CNA · [email protected]
Default status: unknown

15.02.0 ≤ version < 15.02.0986.041 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft Exchange Server 2019 Cumulative Update 12 Source: CNA · [email protected]
Default status: unknown

15.02.0 ≤ version < 15.02.1118.025 — affected (custom)

Platforms: x64-based Systems

Affected Products / Versions

microsoft / exchange_server Source: NVD CPE · affected
Version / affected range: 2013
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
microsoft / exchange_server Source: NVD CPE · affected
Version / affected range: 2016
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
microsoft / exchange_server Source: NVD CPE · affected
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
microsoft / exchange_server Source: NVD CPE · affected
Version / affected range: 2019
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*

References

Last enrichment sync: 06-Nov-2026 10:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Microsoft reports threat actor Storm-1175 is weaponizing CVE-2023-21529 in attacks to deliver Medusa ransomware. CISA Adds Six Exploited Vulnerabilities to KEV Catalog

CVE (5)

Malware (1)

Threat Actors (1)

Vendors (3)

Products (4)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.