Vulnerability Intelligence Report
CVE-2019-1373
A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:18.16%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Microsoft | Microsoft Exchange Server 2019 | Cumulative Update 2 (affected) |
| Microsoft | Microsoft Exchange Server 2016 | Cumulative Update 13 (affected) |
| Microsoft | Microsoft Exchange Server 2013 | Cumulative Update 23 (affected) |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 3 | unspecified (affected) |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 14 | unspecified (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
18.161%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Microsoft Corporation · Vendor · USA |
| Reserved | 2018-11-26T00:00:00 |
| Published | 2019-11-12T18:52:50 |
| Last Updated | 2024-08-04T18:13:30 |
Community Chatter & Buzz