Microsoft Exchange Server Deserialization of Untrusted Data RCE

Successful exploitation allows arbitrary code execution on the vulnerable Exchange Server. Because Exchange is a high-value, centrally connected enterprise service, compromise can provide deep access to sensitive corporate communications and create a strong foothold for follow-on intrusion activity. Reported real-world exploitation has been associated with initial access, data theft, and ransomware deployment, including Medusa operations attributed to Storm-1175.

If immediate patching is not possible, reduce exposure of on-premises Exchange systems by limiting access to trusted networks and administrative users, isolating internet-facing Exchange infrastructure behind appropriate reverse proxy, WAF, or DMZ controls where operationally feasible, and aggressively monitoring Exchange for suspicious authentication and post-compromise activity. Because exploitation requires authentication, hardening credential security, enforcing MFA where applicable for administrative access paths, and rapidly investigating signs of credential theft can reduce risk until patching is completed. If no patch or compensating controls can be applied, discontinue use of the vulnerable service.

Apply Microsoft's February 14, 2023 security updates for affected Microsoft Exchange Server versions. Organizations should ensure all supported Exchange installations are updated to the vendor-fixed builds for Exchange Server 2013 CU23, Exchange Server 2016 CU23, and Exchange Server 2019 CU11/CU12, and verify that no lagging or partially updated Exchange nodes remain in service.