CVE-2023-36744

What it actually does

CVE-2023-36744 is a remote code execution vulnerability in Microsoft Exchange Server. The CVSS vector indicates exploitation is network-adjacent rather than fully internet-routable in the generic scoring model, requires low attack complexity, requires low privileges, and does not require user interaction. Successful exploitation can allow an authenticated attacker with network adjacency to execute code in the Exchange Server context, creating high confidentiality, integrity, and availability impact. Because Exchange commonly runs with broad access to mail data and Active Directory-integrated services, compromise may enable mailbox access, credential theft, lateral movement, persistence, and service disruption.

Why it matters to the business

A successful attack against an Exchange Server can expose sensitive email, attachments, address books, and authentication material, while also enabling interruption or manipulation of business email services. Since Exchange is often a critical communications platform and a foothold into the wider Windows domain, exploitation can lead to data breach response, regulatory exposure, downtime, fraud risk, and broader enterprise compromise. The EPSS score is high, suggesting meaningful likelihood of exploitation activity even though this issue is not currently listed in CISA KEV and no ransomware association is indicated.

How an attack unfolds

An attacker first obtains or already possesses low-privileged credentials and gains network access to the Exchange Server over the required adjacent or reachable network path. They then send crafted requests to the vulnerable Exchange component to trigger the remote code execution condition without requiring interaction from an end user. If exploitation succeeds, attacker-controlled code runs on the Exchange Server, allowing the attacker to establish a stronger foothold, enumerate mailboxes and configuration, access sensitive email content, dump credentials or tokens, deploy web shells or other persistence mechanisms, and pivot toward domain resources. Post-exploitation activity may include mailbox exfiltration, creation of new accounts or role assignments, modification of transport rules, disabling security controls, or staging additional malware.

How to fix it

Apply the Microsoft security updates that address CVE-2023-36744 for the affected Exchange Server versions. Because no exact fixed versions were provided in the input, administrators should use Microsoft’s official Exchange Server Security Updates for the September 2023 release cycle or later cumulative/security updates applicable to their installed Exchange version. Ensure Exchange Server is on a supported Cumulative Update level before applying Security Updates, as Microsoft commonly requires supported CU baselines. If immediate patching is not possible, restrict network access to Exchange administrative and service endpoints, limit access to trusted internal networks or VPNs, enforce MFA where applicable, remove unnecessary exposed services, monitor and disable unused accounts, and harden Exchange according to Microsoft’s Exchange Server Health Checker guidance. Mitigations should be treated as temporary; patching remains the required fix.

How to confirm the fix worked

Confirm the installed Exchange Server build number maps to a Microsoft release that includes the fix for CVE-2023-36744. Run Microsoft Exchange Health Checker and verify that the server is on a supported Cumulative Update and current Security Update. Review installed updates in Windows Update history, Control Panel installed updates, or PowerShell inventory, and compare against Microsoft’s official Exchange Server build number table. Validate that Exchange services start normally after patching, mail flow works, Outlook/OWA/ECP connectivity is functional, and no vulnerable unpatched Exchange servers remain in load-balanced pools, hybrid deployments, lab networks, or disaster recovery environments. Where network mitigation was used, test that only approved sources can reach Exchange administrative interfaces and relevant service ports.

Typical attack path

1. Acquire or reuse low-privileged valid credentials for the organization or Exchange-accessible account.
2. Reach the vulnerable Microsoft Exchange Server over the required network path.
3. Send a crafted request to the vulnerable Exchange service or endpoint to trigger code execution.
4. Execute commands or payloads in the Exchange Server security context.
5. Establish persistence, such as a web shell, scheduled task, service, or malicious Exchange configuration change.
6. Collect email, credentials, tokens, address lists, and Exchange/Active Directory configuration data.
7. Move laterally to other Windows or domain systems or use mailbox access for fraud and further phishing.
8. Cover tracks by deleting files, clearing logs, or blending activity into normal Exchange traffic.

How to detect it

To determine whether exploitation already occurred, review Exchange-facing IIS logs, Exchange application logs, Windows Security logs, PowerShell operational logs, EDR telemetry, Sysmon logs, and Active Directory audit logs from at least September 2023 onward, or from the earliest likely exposure window. Focus on authenticated requests from unusual internal hosts, VPN sources, jump boxes, or compromised workstations to Exchange endpoints, followed by process execution spawned by Exchange worker processes. Hunt for suspicious child processes of w3wp.exe, MSExchange services, or IIS/Exchange application pools, especially cmd.exe, powershell.exe, pwsh.exe, cscript.exe, wscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, mshta.exe, net.exe, nltest.exe, whoami.exe, quser.exe, and procdump.exe. Search for newly created or modified ASPX files in Exchange and IIS web directories, unexpected scheduled tasks, new Windows services, suspicious mailbox export requests, abnormal Exchange Management Shell activity, unauthorized RBAC role changes, newly created transport rules, suspicious inbox rules, and unexplained administrator logons. Review IIS logs for unusual POST requests, anomalous user agents, large response sizes, odd status/substatus patterns, or requests followed immediately by server-side command execution. Correlate Exchange server activity with domain controller authentication events and lateral movement signals such as remote service creation, WinRM, WMI, SMB admin shares, credential dumping, and Kerberos anomalies. No CVE-specific public IOC strings are provided in the input, so detection should emphasize behavioral evidence of Exchange RCE and post-exploitation.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning mshta.exe
• MSExchange* spawning cmd.exe
• MSExchange* spawning powershell.exe
• C:\inetpub\wwwroot\aspnet_client\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\auth\*.aspx
• New-MailboxExportRequest
• New-ManagementRoleAssignment
• New-TransportRule
• Set-TransportRule
• New-InboxRule
• Set-InboxRule
• Event ID 4688
• Event ID 7045
• Event ID 4698
• Microsoft-Windows-PowerShell/Operational Event ID 4104
• Microsoft-Windows-PowerShell/Operational Event ID 4103
• IIS POST requests to /owa/
• IIS POST requests to /ecp/
• IIS POST requests to /PowerShell/

What your security team should do

• Prioritize patching all supported Microsoft Exchange Servers with the relevant Microsoft security updates, given the high EPSS score and high-impact RCE outcome.
• Inventory every Exchange Server, including hybrid, edge, legacy, recovery, and non-production systems, and map each to its exact Cumulative Update and Security Update level.
• Require or rotate credentials for accounts suspected of being exposed, especially low-privileged accounts that can access Exchange and privileged Exchange/Active Directory accounts.
• Restrict Exchange access paths to the minimum required networks and place administrative endpoints behind VPN, privileged access workstations, or equivalent access controls.
• Run Microsoft Exchange Health Checker and Microsoft-provided Exchange security scripts where applicable to identify missing patches or unsafe configuration.
• Hunt for post-exploitation artifacts such as unexpected web shells, suspicious PowerShell execution, new scheduled tasks or services, abnormal mailbox export activity, suspicious inbox rules, and unauthorized role assignments.
• Review Exchange, IIS, Windows Security, PowerShell, Sysmon/EDR, and Active Directory logs for suspicious authenticated activity around the publication date and onward.
• Increase monitoring for credential theft and lateral movement from Exchange servers, including LSASS access, remote service creation, SMB/WMI/WinRM activity, and unusual domain controller connections.
• Back up Exchange configuration and validate restore procedures before patching, then confirm mail flow and client access after updates are applied.