Actively exploited in the wild
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Microsoft - Exchange Server · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-0688
HighCVSS 8.8KEVSummary
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, known as 'Microsoft Exchange Memory Corruption Vulnerability'.
Risk Assessment
An attacker could remotely execute arbitrary code on the Exchange server, potentially leading to full compromise of the mail server and access to organizational data.
Recommendation
Immediately apply the security updates provided by Microsoft for Microsoft Exchange.
Other vulnerabilities in Microsoft Exchange
See all- CVE-2020-17144HighActively exploited
A remote code execution vulnerability in Microsoft Exchange. Technical details are not provided in the description.
- CVE-1999-0993High
Modifications to Access Control Lists (ACLs) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.
- CVE-1999-0682Medium
Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.
- CVE-2023-35368High
A vulnerability in Microsoft Exchange allows for remote code execution, potentially leading to system takeover. An attacker can exploit this flaw to execute arbitrary code on the Exchange server.
Original NVD description (English source)
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.