CVE-2023-36745

What it actually does

CVE-2023-36745 is a remote code execution vulnerability in Microsoft Exchange Server. The CVSS vector indicates exploitation requires adjacent-network access and low-privileged authentication, but no user interaction. Successful exploitation can allow an attacker to execute code in the Exchange Server context, potentially enabling full compromise of mailbox data, server configuration, and the underlying host depending on process privileges and post-exploitation actions. Because Exchange commonly integrates with Active Directory and handles sensitive email, compromise can also provide credential material, internal communications, and a foothold for lateral movement.

Why it matters to the business

An exploited Exchange Server can give an attacker access to sensitive email, business records, credentials, and administrative workflows, and can disrupt email availability. The EPSS score is high, meaning exploitation is statistically more likely than for most vulnerabilities, even though it is not currently listed in CISA KEV and no ransomware use is noted in the provided data. Organizations running exposed or reachable Exchange Server instances should treat remediation as high priority because Exchange compromise can affect confidentiality, operational continuity, regulatory exposure, and incident response costs.

How an attack unfolds

An attacker first needs network reachability to the vulnerable Exchange Server from an adjacent network and valid low-privileged credentials. They then send crafted requests to the vulnerable Exchange component to trigger the remote code execution condition without requiring a victim to click or open anything. If successful, the attacker gains code execution on the Exchange Server and can run commands, deploy web shells or tooling, access mailboxes, harvest credentials, alter server configuration, and pivot into the wider Windows and Active Directory environment. Follow-on activity may include mailbox export, creation of persistence mechanisms, credential dumping, internal reconnaissance, and lateral movement.

How to fix it

Apply the Microsoft security updates that address CVE-2023-36745 for all supported Microsoft Exchange Server installations. Because no fixed versions were provided in the input, use Microsoft’s official Security Update Guide and Exchange Server update documentation to identify the exact cumulative update and security update level required for each deployed Exchange version. Prioritize internet-facing, hybrid, and internally reachable Exchange servers. Ensure Exchange servers are on a supported cumulative update before installing security updates, back up configuration and databases, and follow Microsoft’s recommended post-install steps. If immediate patching is not possible, restrict network access to Exchange management and service endpoints, limit access to trusted networks, enforce multi-factor authentication where applicable, remove unnecessary exposure, monitor for web shell activity, and ensure endpoint protection is active on Exchange hosts. Mitigations should be treated as temporary and not as a replacement for patching.

How to confirm the fix worked

Confirm that every Exchange Server has the applicable Microsoft security update installed and is running a supported cumulative update. Validate using Exchange Management Shell, Windows update inventory, Microsoft Health Checker for Exchange Server, and enterprise vulnerability scanning. Review installed hotfixes and Exchange build numbers against Microsoft’s official fixed build guidance. Re-scan from relevant network locations to verify the vulnerability is no longer detected. Confirm that access controls and segmentation prevent unnecessary adjacent-network or internal access to Exchange services. After patching, review Exchange application, IIS, Windows Security, PowerShell, and EDR telemetry for signs of prior exploitation before returning the system to normal trust.

Typical attack path

1. Obtain low-privileged credentials through phishing, password reuse, credential stuffing, or prior compromise.
2. Gain network reachability to the Exchange Server from an adjacent or internal network segment.
3. Identify Exchange Server version and confirm it is missing the relevant Microsoft security update.
4. Send crafted authenticated requests to trigger the remote code execution flaw.
5. Execute commands or payloads in the Exchange Server context.
6. Establish persistence, commonly by dropping a web shell, scheduled task, service, or additional remote access tool.
7. Access mailboxes, configuration data, and credentials available to the compromised server.
8. Use Exchange and Active Directory access to move laterally or escalate privileges.

How to detect it

To determine whether this vulnerability may already have been exploited, review Exchange and Windows telemetry for authenticated access followed by unusual server-side execution. Prioritize IIS logs for Exchange virtual directories, Exchange application logs, Windows Security logs, PowerShell operational logs, Sysmon or EDR process telemetry, file creation events in Exchange web directories, scheduled task creation, new service installation, and outbound network connections from Exchange servers. Look for low-privileged accounts making unusual requests to Exchange endpoints before command execution or file writes. Investigate IIS worker process or Exchange service child processes launching command interpreters, PowerShell, script engines, archive utilities, download tools, or reconnaissance commands. Search for unexpected .aspx files or recently modified files under Exchange and IIS web roots, especially in OWA, ECP, Autodiscover, and frontend HTTP proxy paths. Review mailbox audit logs for suspicious exports, mass access, inbox rule manipulation, and delegated access changes. Because the provided data does not identify a public exploit string or named threat actor, detection should focus on generic Exchange RCE post-exploitation patterns rather than a single exploit signature.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning mshta.exe
• MSExchangeFrontEndAppPool spawning cmd.exe
• MSExchangeFrontEndAppPool spawning powershell.exe
• C:\inetpub\wwwroot\aspnet_client\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\autodiscover\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\mapi\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\*.aspx
• New-Service
• sc.exe create
• schtasks /create
• powershell -enc
• powershell -nop
• powershell -w hidden
• Invoke-WebRequest
• iwr http
• curl.exe http
• certutil -urlcache
• bitsadmin /transfer
• whoami /all
• nltest /dclist
• net group "Domain Admins" /domain
• Get-MailboxExportRequest
• New-MailboxExportRequest

What your security team should do

• Patch all affected Microsoft Exchange Server instances using the applicable Microsoft security updates as a high priority due to the high EPSS score and the critical role of Exchange infrastructure.
• Inventory all Exchange servers, including hybrid, legacy, disaster recovery, and test systems, and verify their cumulative update and security update levels.
• Prioritize servers reachable from user networks, VPN ranges, partner networks, or the internet, even though the CVSS vector indicates adjacent-network exploitation.
• Review authentication logs for low-privileged accounts accessing Exchange from unusual locations or at unusual times before suspicious server-side activity.
• Hunt for post-exploitation artifacts such as web shells, suspicious PowerShell, abnormal child processes spawned by IIS or Exchange services, new scheduled tasks, and unexpected services.
• Restrict Exchange administrative and service endpoints to trusted management networks and enforce least privilege for Exchange-related roles.
• Run Microsoft Exchange Health Checker and enterprise vulnerability scans after remediation to confirm exposure is closed.
• Preserve logs and forensic artifacts if suspicious activity is found, because Exchange compromises often involve mailbox theft, credential access, and lateral movement.