Improper authentication in Microsoft Exchange Server 2013
Priority CRITICAL 97Exploited in the wildCWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use
EPSS 0.99955 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Exchange Server 2013 | Cumulative Update 23 | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 3 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 14 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 15 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 4 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 | all versions | — | No fix listed | CNA |
- Microsoft Exchange Server 2013 VendorMicrosoft Affected Cumulative Update 23 Fixed in — No fix listed CNA
- Microsoft Exchange Server 2019 Cumulative Update 3 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Exchange Server 2016 Cumulative Update 14 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Exchange Server 2016 Cumulative Update 15 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Exchange Server 2019 Cumulative Update 4 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_30:*:*:*:*:*:* | 2010 sp3_rollup_30 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* | 2013 cumulative_update_23 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* | 2016 cumulative_update_14 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* | 2016 cumulative_update_15 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* | 2019 cumulative_update_3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* | 2019 cumulative_update_4 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_30:*:*:*:*:*:* Versions 2010 sp3_rollup_30 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* Versions 2013 cumulative_update_23 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:* Versions 2016 cumulative_update_14 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:* Versions 2016 cumulative_update_15 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:* Versions 2019 cumulative_update_3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:* Versions 2019 cumulative_update_4 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-0688
- 2026-10-03 Alias added: GHSA-4g56-8mc7-hpjq
References
Exploit 2
More Microsoft Exchange Server vulnerabilities
- TI-2024-14170 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2022-19610 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-13547 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-13502 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-08465 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07929 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2020-0688 · CVE Program
- CVE-2020-0688 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-4g56-8mc7-hpjq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences