First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-21529

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Aug 19, 2026

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	>= 15.00.0, < 15.00.1497.047
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	>= 15.01.0, < 15.01.2507.021
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 11	>= 15.02.0, < 15.02.0986.041
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 12	>= 15.02.0, < 15.02.1118.025

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529Patch, Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529US Government Resource
https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/Technical Description

Timeline

Published: Feb 14, 2023
Last modified: Aug 19, 2026
Added to CISA KEV: Apr 13, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-21536.1A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some un CVE-2023-215317.0Azure Service Fabric Container Elevation of Privilege Vulnerability CVE-2023-215327.0Windows GDI Elevation of Privilege Vulnerability CVE-2023-215358.1Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability CVE-2023-215364.7Event Tracing for Windows Information Disclosure Vulnerability CVE-2023-215377.8Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability CVE-2023-215387.5.NET Denial of Service Vulnerability CVE-2023-215397.5Windows Authentication Remote Code Execution Vulnerability CVE-2023-21547.2A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of th CVE-2023-215405.5Windows Cryptographic Information Disclosure Vulnerability CVE-2023-215417.8Windows Task Scheduler Elevation of Privilege Vulnerability CVE-2023-215427.0Windows Installer Elevation of Privilege Vulnerability