Actively exploited in the wild
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft - Exchange Server · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-17144
HighCVSS 8.4KEVSummary
A remote code execution vulnerability in Microsoft Exchange. Technical details are not provided in the description.
Risk Assessment
An attacker could remotely execute arbitrary code on the Exchange server, potentially leading to full system compromise. However, specific conditions are required.
Recommendation
Immediately apply available security updates for Microsoft Exchange. Monitoring for unusual activity on Exchange servers is also recommended.
Other vulnerabilities in Microsoft Exchange
See all- CVE-2020-0688HighActively exploited
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, known as 'Microsoft Exchange Memory Corruption Vulnerability'.
- CVE-1999-0993High
Modifications to Access Control Lists (ACLs) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.
- CVE-1999-0682Medium
Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.
- CVE-2023-35368High
A vulnerability in Microsoft Exchange allows for remote code execution, potentially leading to system takeover. An attacker can exploit this flaw to execute arbitrary code on the Exchange server.
Original NVD description (English source)
Microsoft Exchange Remote Code Execution Vulnerability