Microsoft Exchange Server Elevation of Privilege Vulnerability
Why It Matters
Analysis dossierWhy It Matters
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Medium
No
Unknown
Risk basis: No confirmed exploitation signal in current enrichment
Affected Products & Remediation
4 source-backed products- Microsoft Exchange Server Subscription Edition RTM · version range not provided by source · Microsoft MSRC · Source
- Microsoft Exchange Server 2016 Cumulative Update 23 · version range not provided by source · Microsoft MSRC · Source
- Microsoft Exchange Server 2019 Cumulative Update 15 · version range not provided by source · Microsoft MSRC · Source
- Microsoft Exchange Server 2019 Cumulative Update 14 · version range not provided by source · Microsoft MSRC · Source
Vendor or catalog guidance (source)
- Microsoft MSRC: Install the security update KB5121573 listed by MSRC
- Microsoft MSRC: Install the security update KB5121576 listed by MSRC
- Microsoft MSRC: Install the security update KB5121574 listed by MSRC
- Microsoft MSRC: Install the security update KB5121575 listed by MSRC
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- No
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched microsoft-enterprise (Affected product: Microsoft Exchange Server Subscription Edition RTM, Vendor: Microsoft)
Exposure
- Identify affected Microsoft products and compare local builds with the MSRC advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · The MSRC product/build mapping establishes applicability. · Rule microsoft-enterprise
Exploitation evidence
- Review the advisory's documented behavior on matching hosts before selecting a hunt.Telemetry: DeviceProcessEvents · Product family alone does not justify a CVE-specific detection. · Rule microsoft-enterprise
Response
- Confirm the source-stated KB or mitigation on matching assets.Telemetry: DeviceTvmSoftwareVulnerabilities · A post-update inventory check verifies remediation. · Rule microsoft-enterprise
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- Unknown
- Record status · verification
- UPDATED · Unknown
- CPE
- Unknown
Evidence & Provenance
— No published hunting query names this record. Browse community and library queries instead.