CVE-2023-36756

What it actually does

CVE-2023-36756 is a remote code execution vulnerability in Microsoft Exchange Server. An attacker with low-privileged credentials and access from an adjacent network position can send crafted requests to a vulnerable Exchange server and cause the server to execute attacker-controlled code. Successful exploitation can compromise confidentiality, integrity, and availability of the Exchange host because code execution occurs on a system that commonly has access to mailboxes, directory-integrated authentication, and sensitive internal communications.

Why it matters to the business

Compromise of Exchange can expose email, credentials, attachments, internal business discussions, and authentication material, and can also disrupt mail flow. Even though this issue is not listed in CISA KEV and the provided exploit maturity is none, the EPSS score is high, Exchange is a frequent target, and the vulnerability has been public for a long time, so unpatched systems represent meaningful operational risk.

How an attack unfolds

An attacker first needs a path to the same adjacent network segment or otherwise meet the adjacent-network access requirement, plus low-privileged authentication to the Exchange environment. The attacker then sends specially crafted traffic to a vulnerable Exchange service. If the server is missing the applicable Microsoft security update, Exchange mishandles the crafted input and allows the attacker to execute code on the server. After code execution, a typical attacker would establish persistence, dump configuration and credentials, access mailboxes, search for sensitive data, and attempt lateral movement into Active Directory or other internal systems.

How to fix it

Apply the applicable Microsoft Exchange Server security updates from September 2023 or any later cumulative/security update that supersedes them. Because no exact fixed versions were provided in the input, use Microsoft’s official Exchange Server update guidance for the deployed Exchange major version and bring servers to a supported cumulative update level before applying the latest security update if required. Patch all Exchange servers, including hybrid, management, mailbox, and edge roles where applicable. Restrict Exchange administrative and service access to trusted networks, reduce unnecessary internal reachability, enforce MFA for administrative accounts, monitor for anomalous authenticated access, and ensure unsupported Exchange versions are upgraded or removed.

How to confirm the fix worked

Confirm the installed Exchange Server build and security update level against Microsoft’s official Exchange Server build number documentation. Run Microsoft Exchange Health Checker and verify it reports current supported cumulative and security update levels. Confirm all Exchange servers in the organization, including standby or hybrid servers, are inventoried and patched. Validate that low-privileged authenticated users cannot reach unnecessary Exchange administrative endpoints from untrusted or broadly shared network segments. Review vulnerability scanner results and confirm CVE-2023-36756 is no longer detected after patching.

Typical attack path

1. Obtain adjacent network access to the Exchange server or a network position that satisfies the vulnerability’s attack vector.
2. Acquire or use low-privileged valid credentials for the Exchange environment.
3. Identify an Exchange server that has not received the September 2023 or later applicable security updates.
4. Send crafted requests to the vulnerable Exchange service to trigger remote code execution.
5. Execute commands or payloads under the Exchange service context.
6. Collect mailbox data, configuration files, tokens, certificates, or credentials available from the server.
7. Deploy persistence such as web shells, scheduled tasks, services, or modified application files.
8. Use the compromised Exchange server as a foothold for internal reconnaissance and lateral movement.

How to detect it

To assess prior exploitation, review Exchange IIS logs, Windows Security logs, PowerShell logs, Exchange protocol logs, ECP/OWA activity, antivirus/EDR telemetry, and file-system changes under Exchange web and application directories. Look for authenticated low-privileged accounts making unusual requests before suspicious process creation, especially requests from unexpected internal or adjacent-network IP ranges. Correlate Exchange or IIS worker processes spawning command shells, scripting engines, archive tools, download utilities, or credential-dumping tools. Inspect for newly created or modified ASPX files in Exchange web-accessible directories, unexpected scheduled tasks or services, anomalous mailbox export/search activity, and unusual outbound connections from Exchange servers. Because no public exploit pattern or vendor-specific exploit string is provided in the input, detection should focus on Exchange post-exploitation behavior rather than a single request signature.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• MSExchangePowerShellAppPool spawning cmd.exe
• MSExchangePowerShellAppPool spawning powershell.exe
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy
• C:\inetpub\logs\LogFiles

What your security team should do

• Prioritize patching all Microsoft Exchange servers because the EPSS score is high and Exchange compromise has severe downstream impact.
• Inventory every Exchange server, including hybrid and legacy systems, and verify the installed build against Microsoft’s supported patched versions.
• Run Microsoft Exchange Health Checker after patching and remediate any unsupported cumulative update, missing security update, or insecure configuration findings.
• Restrict network paths to Exchange management and internal service endpoints to only required systems and administrator workstations.
• Hunt for post-exploitation artifacts such as unexpected web files, suspicious child processes spawned by Exchange or IIS worker processes, new services, scheduled tasks, and anomalous mailbox access.
• Review authentication logs for low-privileged accounts accessing Exchange from unusual adjacent network locations or at unusual times.
• If evidence of compromise is found, isolate the server, preserve forensic artifacts, rotate credentials that may have been exposed, and rebuild from trusted media where appropriate.