{"id":"exchange-deserialization-rce-cisa-kev-apr-2026","category":"patch","status":"closed","title":"Microsoft Exchange Server deserialization flaw CVE-2023-21529 listed by CISA as used in attacks, including ransomware","tldr":"CISA says an old Exchange Server flaw, CVE-2023-21529, is being used in attacks, including ransomware. Any signed-in user could run code on the server. Organisations running their own Exchange should check they are on the fixed builds from Microsoft; home users are unaffected.","summary":"On 13 April 2026 CISA added CVE-2023-21529 to its list of flaws being used in attacks and marked it as used in ransomware. It is a deserialization flaw in on-premises Microsoft Exchange Server that lets an attacker who already has a valid login run their own code on the server. Microsoft rates it 8.8 out of 10. The flaw is old and a fix exists: the fixed builds are Exchange 2013 CU23 15.00.1497.047, 2016 CU23 15.01.2507.021, 2019 CU11 15.02.0986.041 and 2019 CU12 15.02.1118.025. A week earlier, on 6 April, Microsoft's threat intelligence team named the flaw among those used since 2023 by Storm-1175, a financially motivated group that deploys Medusa ransomware; Microsoft's report gives no detail on how this flaw was used. Microsoft's own advisory page would not load for us, so the build numbers come from CISA's listing data. We found no newer developments. This affects businesses that run their own Exchange servers, not people using Outlook or hosted email.","action":"If your business or your family office runs its own Exchange Server, ask your IT provider to confirm it is on a build at or above the fixed versions in Microsoft's advisory. Hosted email such as Microsoft 365 needs nothing from you.","product":"Microsoft Exchange Server (on-premises) 2013, 2016 and 2019","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2023-21529"],"tags":["microsoft","exchange","ransomware","cisa-kev","deserialization","remote-code-execution","medusa"],"affected":["Microsoft Exchange Server 2013 Cumulative Update 23 below 15.00.1497.047","Microsoft Exchange Server 2016 Cumulative Update 23 below 15.01.2507.021","Microsoft Exchange Server 2019 Cumulative Update 11 below 15.02.0986.041","Microsoft Exchange Server 2019 Cumulative Update 12 below 15.02.1118.025"],"fixed":["Exchange Server 2013 CU23: 15.00.1497.047","Exchange Server 2016 CU23: 15.01.2507.021","Exchange Server 2019 CU11: 15.02.0986.041","Exchange Server 2019 CU12: 15.02.1118.025"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft Security Update Guide: CVE-2023-21529","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529","by":"Microsoft","date":"2026-04-13"},{"kind":"research","title":"Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations","url":"https://microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations","by":"Microsoft","date":"2026-04-06"},{"kind":"news","title":"CISA adds exploited Microsoft Exchange and Windows CLFS flaws to KEV list","url":"https://vpncentral.com/?p=248459","by":"VPNCentral","date":"2026-04-13"}],"started":"2026-04-06","closed":"2026-04-13","created":"2026-11-03T22:02:33.664Z","updated":"2026-11-03T22:02:33.664Z","cve_notes":[{"cve":"CVE-2023-21529","name":"Deserialization remote code execution in Exchange Server","what":"A deserialization flaw in on-premises Microsoft Exchange Server that lets an attacker with a valid login send crafted data and run their own code on the server.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-04-13","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Microsoft's security update guide entry for the flaw is the vendor reference for the affected and fixed Exchange builds: 2013 CU23 15.00.1497.047, 2016 CU23 15.01.2507.021, 2019 CU11 15.02.0986.041 and 2019 CU12 15.02.1118.025. The page did not load for us, so these builds come from CISA's listing data.","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529","by":"Microsoft","patch":"patched"},{"at":"2026-04-13","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2023-21529, an Exchange Server deserialization flaw that lets a signed-in attacker run code, to its Known Exploited Vulnerabilities list, flagged as used in ransomware. Reports say it was added alongside a Windows CLFS flaw, CVE-2023-36424.","url":"https://vpncentral.com/?p=248459","by":"VPNCentral","patch":"patched"},{"at":"2026-04-06","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Microsoft Threat Intelligence published its report on Storm-1175, a financially motivated group that deploys Medusa ransomware. The report lists CVE-2023-21529, listed only as affecting Microsoft Exchange, among the flaws the group has exploited since 2023, and does not describe how it was used.","url":"https://microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations","by":"Microsoft","patch":null}],"url":"https://hard.fyi/live/exchange-deserialization-rce-cisa-kev-apr-2026/","json":"https://hard.fyi/api/live?id=exchange-deserialization-rce-cisa-kev-apr-2026"}