CVE Watch—

CVE-2023-21529

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

CVSS

—

No CVSS

EPSS

62.1%

p99

KEV

YES

Apr 13, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

62.1%EPSS · 30 days62.1%

2026-06-302026-07-16

KEV catalog record

Product

Microsoft / Exchange Server

Vulnerability

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Added to KEV

Apr 13, 2026

Remediate by

Apr 27, 2026

Known ransomware use

Yes

Summary description

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-34473—

100.0%

KEV—80Microsoft Exchange Server Remote Code Execution Vulnerability—CVE-2021-26855—

100.0%

KEV—80Microsoft Exchange Server Remote Code Execution Vulnerability—CVE-2022-41040—

100.0%

KEV—80Microsoft Exchange Server Server-Side Request Forgery Vulnerability—CVE-2021-27065—

100.0%

KEV—80Microsoft Exchange Server Remote Code Execution Vulnerability—CVE-2021-34523—

100.0%

KEV—80Microsoft Exchange Server Privilege Escalation Vulnerability—CVE-2022-41082—

100.0%

KEV—80Microsoft Exchange Server Remote Code Execution Vulnerability—