Deserialization of Untrusted Data in Microsoft Exchange Server (CVE-2023-21529) — Authenticated Remote Code Execution, Confirmed in Ransomware

Deserialization is the process by which a program reconstructs data that was serialized — converted into a linear form for storage or transmission — back into its original objects (bundles of data). Feed "untrusted data," i.e. input crafted by an attacker, into that step and there is room for the attacker's intended logic to run during reconstruction.

That is the deserialization flaw (CWE-502): a high-impact class in which merely sending a crafted "object" can make the server execute code. Here that is said to be possible on Microsoft Exchange Server.

In the vector (CVSS:3.1 AV:N/AC:L/PR:L/UI:N …), PR:L signals that the attack requires some privilege (login). At a glance "it needs authentication, so it's safe" seems reassuring, but in real attacks the standard playbook is to first obtain a low-privilege account — via phishing or stolen reused passwords — and then use a flaw like this as a stepping stone to widen privileges. "Authenticated only" is no cause for comfort.

Crucially, this flaw has confirmed use in ransomware attacks (recorded by CISA as known ransomware use). Exchange carries email, an organization's lifeline, and has previously been the stage for large incidents such as ProxyLogon and ProxyShell. Seizing the email backbone widens the damage — from theft of confidential correspondence to impersonated sending and lateral movement into other systems.

That a 2023 flaw entered the KEV in 2026 shows unpatched Exchange remains a real target today. The response is to update per Microsoft's guidance; CISA set the remediation due date to 2026-04-27.