CVE-2023-36757

What it actually does

CVE-2023-36757 is a Microsoft Exchange Server spoofing vulnerability in the authentication boundary. An attacker with low-privileged credentials and adjacent-network access can craft requests that cause Exchange to trust or mis-handle the asserted identity or authentication context. Because the flaw affects authentication handling, successful exploitation can result in unauthorized access to mailbox data or Exchange functions and may enable further actions with elevated impact to confidentiality, integrity, and availability. The CVSS vector indicates exploitation requires network adjacency and valid low-privileged access, but no user interaction.

Why it matters to the business

A successful attack against an exposed or reachable Exchange server could let an attacker impersonate trusted access, read or manipulate email, and use Exchange as a foothold for broader internal compromise. Email systems commonly contain sensitive business communications, credentials, contracts, legal material, and operational workflows, so compromise can lead to data theft, fraud, downtime, regulatory exposure, and loss of trust. Although this CVE is not currently listed in CISA KEV and public exploit maturity is reported as none, the EPSS score is high, so organizations should treat unpatched Exchange systems as a meaningful risk.

How an attack unfolds

An attacker first needs reachability to the Exchange service from an adjacent network position and possession of a valid low-privileged account. From that position, the attacker sends specially crafted authentication or Exchange protocol requests to a vulnerable server. The server incorrectly handles the spoofed authentication context, allowing the attacker to act as or access resources beyond what the original account should permit. After successful spoofing, the attacker may enumerate mailboxes, access email content, interact with Exchange endpoints such as OWA, ECP, EWS, MAPI, Autodiscover, or Exchange PowerShell, and attempt follow-on actions such as mailbox rule creation, credential harvesting, internal phishing, or lateral movement using information obtained from mail.

How to fix it

Install the applicable Microsoft Exchange Server security updates released in September 2023 or any later cumulative/security update that supersedes them. If the server is not on a supported Exchange cumulative update level, first upgrade to a supported CU and then apply the latest security update. Because no exact fixed build numbers were provided in the input, use Microsoft’s Exchange Server Health Checker and official Exchange update guidance to verify the installed build is current and supported. As compensating controls, restrict Exchange administrative and client-access interfaces to trusted networks, reduce or disable NTLM where feasible, enforce strong authentication and privileged access controls, monitor and limit low-privileged account access, remove unsupported Exchange versions, and ensure Extended Protection and related Exchange hardening recommendations are enabled where supported and compatible.

How to confirm the fix worked

Confirm the installed Exchange build includes the September 2023 security update or a later superseding update. Run Microsoft Exchange Health Checker and verify it reports the server as current, supported, and not missing relevant security updates. Review Exchange Control Panel, OWA, EWS, MAPI, Autodiscover, and PowerShell virtual directory exposure and confirm access is limited as intended. Validate that low-privileged accounts cannot access mailboxes, administrative endpoints, or Exchange functions outside their assigned permissions. If vulnerability scanning is used, authenticate the scan where possible and verify the scanner checks Exchange build numbers rather than only service banners.

Typical attack path

1. Gain adjacent-network access to the Exchange server or a network segment that can reach Exchange services.
2. Obtain or compromise a valid low-privileged domain or Exchange account.
3. Identify vulnerable Microsoft Exchange Server instances that have not received the September 2023 or later security updates.
4. Send crafted authentication or Exchange protocol requests that exploit the spoofing flaw.
5. Abuse the mis-handled authentication context to access Exchange resources or functions beyond the account’s intended permissions.
6. Review mailbox contents, address lists, configuration data, or exposed Exchange interfaces for sensitive information.
7. Use obtained email data or access to support further compromise, fraud, phishing, or lateral movement.

How to detect it

There are no widely recognized public exploit strings or file artifacts specific to this vulnerability. To determine whether exploitation may have occurred, review Microsoft Exchange IIS logs, Exchange application logs, Windows Security event logs, Exchange Admin Audit logs, mailbox audit logs, and PowerShell operational logs for suspicious authentication and access patterns. Focus on low-privileged accounts accessing sensitive mailboxes or administrative endpoints, successful logons from unusual adjacent-network hosts, unexpected transitions from normal mailbox use to ECP or Exchange PowerShell activity, and mailbox actions inconsistent with the user’s role. Relevant Windows events include successful and failed logons, explicit credential use, privileged logons, and process creation if enabled. In IIS logs, examine requests to /owa, /ecp, /ews, /mapi, /autodiscover, and /powershell where the authenticated username, source IP, user agent, or request pattern is anomalous. Also review for newly created inbox rules, mailbox delegation changes, transport rule changes, unusual mailbox export activity, and unexpected Exchange management cmdlets executed by non-administrative users. Because exploitation requires credentials, correlate suspicious Exchange activity with signs of account compromise such as impossible travel, password-spray attempts, NTLM relay indicators, or unusual internal authentication sources.

What your security team should do

• Prioritize patching all Microsoft Exchange Server systems with the latest supported cumulative update and security update, despite the absence of KEV listing, because the EPSS probability is high.
• Inventory all Exchange servers, including hybrid, staging, disaster recovery, and internet-adjacent systems, and confirm each is on a supported and patched build.
• Restrict access to Exchange administrative endpoints such as ECP and Exchange PowerShell to trusted administrative networks.
• Review recent Exchange and Windows authentication logs for anomalous low-privileged account activity, especially from adjacent-network hosts or unusual internal source addresses.
• Harden Exchange authentication paths by enabling supported Microsoft-recommended protections such as Extended Protection, reducing NTLM exposure where feasible, and enforcing least privilege.
• Audit mailbox delegation, inbox rules, transport rules, application permissions, and recent administrative changes for suspicious modifications.
• Prepare an incident response workflow for Exchange compromise, including mailbox access review, credential rotation, and forensic preservation of IIS, Exchange, and Windows event logs.