Grey Noise Analysis Of A Quartet of Exchange Remote Code Execution Vulnerabilities: CVE-2023-21529; CVE-2023-21706; CVE-2023-21707; CVE-2023-21710

Summary: Microsoft's February Patch Tuesday disclosed four remote code execution vulnerabilities in Exchange - CVE-2023-21529, CVE-2023-21706, CVE-2023-21707 and CVE-2023-21710 - all of which require attackers to have valid authentication before exploitation, after which they could execute code on the Exchange server as SYSTEM. Shadowserver found over 87,000 Exchange instances vulnerable to CVE-2023-21529, the likely entry point of the four, and as of the post's publication there were no known public proof-of-concept exploits.
What you should know: Three of these four flaws mirror CVE-2022-41082, the ProxyNotShell bug, where a separate server-side request forgery weakness was chained in to bypass the authentication requirement - so the 87,000 exposed instances matter most if an SSRF bypass or credential brute-force shows up, which GreyNoise says it is watching for.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-41082 CVE-2023-21529 CVE-2023-21706 CVE-2023-21707 CVE-2023-21710
Related: Microsoft Patch Tuesday, February 2023 Edition Cyber Risks ·
CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Apr 13, 2026
CVE-2022-41082: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Sep 30, 2022