Description
<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p>
<p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 5 | 15.02.0 – < publication | publication |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 6 | 15.02.0 – < publication | publication |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 16 | 15.01.0 – < publication | publication |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 17 | 15.01.0 – < publication | publication |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE
exploit/windows/http/exchange_ecp_dlp_policy
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.