# CVE-2023-21529: Microsoft Exchange Server deserialization remote code execution

Source: https://junglewise.ai/threats/cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2023-21529 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-04-13

Microsoft Exchange Server is a widely used platform for corporate email, calendaring, and collaboration. A security flaw allows an attacker with basic user credentials to take full control of the email server. This could lead to the theft of sensitive communications, disruption of business operations, or serve as a foothold for ransomware attacks within the organization.

Technologies: [Microsoft Exchange Server](https://junglewise.ai/threats/technologies/exchange-server). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2023-21529 exploited in the wild?** Yes. CVE-2023-21529 is known to be exploited in the wild, first recorded on 13 April 2026. Treat it as urgent.

**How severe is CVE-2023-21529?** Critical severity, with a CVSS score of 8.8, published 13 April 2026.

**Which products and versions are affected?** Microsoft Exchange Server Cumulative Update 23.

**Is there a fix for CVE-2023-21529?** A patch was published on 2024-11-21: Microsoft update guide reference added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-21529 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2023-21529?** Check whether you run Microsoft Exchange Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability (CWE-502) exists in Microsoft Exchange Server due to the improper handling of untrusted data. An attacker with low-privileged credentials can exploit this flaw over the network without user interaction. Successful exploitation allows the attacker to execute arbitrary code in the context of the server, potentially leading to full system compromise. This vulnerability has been observed being exploited in the wild, specifically in association with ransomware operations. Microsoft has released patches to address this issue across supported versions of Exchange Server.

## Affected products

- Microsoft Exchange Server 2013 Cumulative Update 23
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 11, Cumulative Update 12

## Timeline

- 2023-02-14: disclosed: Initial NVD publication date
- 2024-11-21: patched: Microsoft update guide reference added
- 2026-04-13: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [Microsoft Exchange Server improper access control spoofing](https://junglewise.ai/threats/cve-2026-118208-improper-access-control-in-microsoft-exchange-server-allows-an)
- [Microsoft Exchange Server improper input validation code execution](https://junglewise.ai/threats/cve-2026-118207-improper-input-validation-in-microsoft-exchange-server-allows-an)
- [Microsoft Exchange Server weak authentication privilege elevation](https://junglewise.ai/threats/cve-2026-118157-weak-authentication-in-microsoft-exchange-server-allows-an)
- [Microsoft Exchange Server privilege elevation via untrusted security decision input](https://junglewise.ai/threats/cve-2026-118154-reliance-on-untrusted-inputs-in-a-security-decision-in-microsoft)
- [Microsoft Exchange Server algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-118153-inefficient-algorithmic-complexity-in-microsoft-exchange-server)