Microsoft Exchange Server deserialization flaw CVE-2023-21529 listed by CISA as used in attacks, including ransomware
CISA says an old Exchange Server flaw, CVE-2023-21529, is being used in attacks, including ransomware. Any signed-in user could run code on the server. Organisations running their own Exchange should check they are on the fixed builds from Microsoft; home users are unaffected.
If your business or your family office runs its own Exchange Server, ask your IT provider to confirm it is on a build at or above the fixed versions in Microsoft's advisory. Hosted email such as Microsoft 365 needs nothing from you.
What’s happening
On 13 April 2026 CISA added CVE-2023-21529 to its list of flaws being used in attacks and marked it as used in ransomware. It is a deserialization flaw in on-premises Microsoft Exchange Server that lets an attacker who already has a valid login run their own code on the server. Microsoft rates it 8.8 out of 10. The flaw is old and a fix exists: the fixed builds are Exchange 2013 CU23 15.00.1497.047, 2016 CU23 15.01.2507.021, 2019 CU11 15.02.0986.041 and 2019 CU12 15.02.1118.025. A week earlier, on 6 April, Microsoft's threat intelligence team named the flaw among those used since 2023 by Storm-1175, a financially motivated group that deploys Medusa ransomware; Microsoft's report gives no detail on how this flaw was used. Microsoft's own advisory page would not load for us, so the build numbers come from CISA's listing data. We found no newer developments. This affects businesses that run their own Exchange servers, not people using Outlook or hosted email.
- What
- Flaw
- Affects
- Microsoft Exchange Server (on-premises) 2013, 2016 and 2019
- Affected
- Microsoft Exchange Server 2013 Cumulative Update 23 below 15.00.1497.047
Microsoft Exchange Server 2016 Cumulative Update 23 below 15.01.2507.021
Microsoft Exchange Server 2019 Cumulative Update 11 below 15.02.0986.041
Microsoft Exchange Server 2019 Cumulative Update 12 below 15.02.1118.025 - Fixed in
- Exchange Server 2013 CU23: 15.00.1497.047
Exchange Server 2016 CU23: 15.01.2507.021
Exchange Server 2019 CU11: 15.02.0986.041
Exchange Server 2019 CU12: 15.02.1118.025 - Since
- 6 Apr 2026
- Closed
- 13 Apr 2026
Timeline
- UpdateFixed
Microsoft's security update guide entry for the flaw is the vendor reference for the affected and fixed Exchange builds: 2013 CU23 15.00.1497.047, 2016 CU23 15.01.2507.021, 2019 CU11 15.02.0986.041 and 2019 CU12 15.02.1118.025. The page did not load for us, so these builds come from CISA's listing data.
- CISA addedFixed
CISA added CVE-2023-21529, an Exchange Server deserialization flaw that lets a signed-in attacker run code, to its Known Exploited Vulnerabilities list, flagged as used in ransomware. Reports say it was added alongside a Windows CLFS flaw, CVE-2023-36424.
- Wider attacks
Microsoft Threat Intelligence published its report on Storm-1175, a financially motivated group that deploys Medusa ransomware. The report lists CVE-2023-21529, listed only as affecting Microsoft Exchange, among the flaws the group has exploited since 2023, and does not describe how it was used.
Sources
- Microsoft Security Update Guide: CVE-2023-21529Microsoft · 13 Apr 2026
- Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operationsMicrosoft · 6 Apr 2026
- CISA adds exploited Microsoft Exchange and Windows CLFS flaws to KEV listVPNCentral · 13 Apr 2026