CVE-2023-21707

What it actually does

CVE-2023-21707 is a Microsoft Exchange Server remote code execution vulnerability. The CVSS vector indicates exploitation is network-accessible, low-complexity, requires low privileges, and does not require user interaction. Successful exploitation can allow an authenticated attacker to execute code in the context available to the vulnerable Exchange component, potentially compromising confidentiality, integrity, and availability of the mail server and the data it handles.

Why it matters to the business

A compromised Exchange server can expose sensitive email, enable mailbox tampering, disrupt business communications, and provide an attacker with a foothold inside the organization. Because Exchange is often internet-facing and highly trusted by internal systems, exploitation can lead to broader operational risk even though the flaw requires some level of authentication. The high EPSS score indicates a comparatively elevated likelihood of exploitation activity, so unpatched Exchange deployments should be treated as a priority exposure.

How an attack unfolds

An attacker first obtains or abuses low-privileged credentials for an Exchange-accessible account, then connects to the vulnerable Exchange service over the network. The attacker sends crafted requests that trigger the vulnerable code path and cause attacker-controlled code to execute on the server. After execution, the attacker may attempt to establish persistence, access mailbox contents, harvest credentials or tokens, move laterally to adjacent systems, deploy web shells or tooling, and use the Exchange server as a trusted pivot point for further compromise.

How to fix it

Apply the relevant Microsoft Exchange Server security updates that include the fix for CVE-2023-21707. If exact fixed build numbers are not available in the provided data, use Microsoft’s official Exchange Server Health Checker and update guidance to confirm the required Cumulative Update and Security Update level for the deployed Exchange version. Prioritize internet-facing Exchange servers and any systems that process untrusted mail or remote client traffic. Where immediate patching is not possible, reduce exposure by restricting access to Exchange administrative and client endpoints, enforcing MFA, disabling unnecessary services, monitoring authenticated access anomalies, and ensuring endpoint protection is active on Exchange hosts. Mitigations should be considered temporary and not a replacement for installing the vendor fix.

How to confirm the fix worked

Confirm that every Exchange server is running a supported cumulative update and the Microsoft security update that addresses CVE-2023-21707. Use Microsoft Exchange Server Health Checker, Exchange Management Shell build/version checks, Windows installed update inventory, and vulnerability scanning to validate patch status. From an exposure perspective, verify that Exchange services are not unnecessarily exposed to the internet, that authentication protections such as MFA and conditional access are enforced where applicable, and that administrative endpoints are restricted. Re-run authenticated vulnerability scans after patching and confirm scanner plugins no longer report CVE-2023-21707.

Typical attack path

1. Identify an exposed Microsoft Exchange Server instance and determine whether it is likely running a vulnerable build.
2. Obtain valid low-privileged credentials through phishing, credential stuffing, password reuse, prior compromise, or purchased access.
3. Authenticate to the Exchange service and send crafted network requests that trigger the remote code execution condition.
4. Execute commands or payloads under the privileges of the affected Exchange component.
5. Perform post-exploitation actions such as mailbox access, credential harvesting, persistence deployment, web shell placement, lateral movement, or data exfiltration.
6. Attempt to erase or blend activity in Exchange, IIS, Windows event, and endpoint security logs.

How to detect it

Investigate IIS logs, Exchange HTTP proxy logs, Exchange Management logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, and file-system artifacts on Exchange servers. Focus on authenticated access from unusual IP addresses, abnormal user agents, unexpected requests to Exchange endpoints, suspicious PowerShell execution, command shells launched by web or Exchange worker processes, newly created files in Exchange web-accessible directories, unusual mailbox export or access patterns, and privilege or service creation events after suspicious Exchange activity. Because this vulnerability requires low privileges, correlate suspicious requests with account anomalies such as impossible travel, failed login bursts followed by success, unusual service account usage, and logins from hosting providers or anonymization infrastructure. Also review for post-exploitation behavior rather than relying only on vulnerability-specific request signatures, since public exploit maturity is listed as none and precise exploit strings are not derivable from the provided data.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• MSExchangeFrontendTransport.exe spawning cmd.exe
• MSExchangeFrontendTransport.exe spawning powershell.exe
• MSExchangeMailboxReplication.exe spawning cmd.exe
• MSExchangeMailboxReplication.exe spawning powershell.exe
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.ashx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.ashx
• New-Service
• sc.exe create
• powershell -enc
• powershell -EncodedCommand
• Event ID 4688
• Event ID 7045

What your security team should do

• Inventory all Microsoft Exchange Server instances, including hybrid, legacy, standby, and internet-facing servers.
• Prioritize patching of externally reachable Exchange servers and systems handling production mail traffic.
• Verify deployed Exchange cumulative update and security update levels using Microsoft Exchange Health Checker or equivalent authenticated inventory.
• Review recent authenticated Exchange and IIS activity for suspicious requests, unusual account usage, and signs of post-exploitation activity.
• Harden access by enforcing MFA, disabling legacy authentication where feasible, restricting administrative endpoints, and limiting inbound exposure to required sources.
• Hunt for web shells, suspicious child processes spawned by Exchange or IIS worker processes, and unexpected files in Exchange web directories.
• Ensure Exchange servers are covered by EDR, centralized logging, and tamper-resistant backups.
• Rotate credentials for accounts suspected of being used against Exchange and review privileged group membership changes.