CVE-2020-16875

Microsoft Exchange Server Remote Code Execution Vulnerability

High · published September 11, 2020

CVSS v3.1
8.4
EPSS
46%
Percentile
98.8
In the wild
Unconfirmed
What it is

<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p>

<p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p>

<p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.46497 · 98.8th percentile
Published
2020-09-11T17:08Z
EPSS history
Timeline
  • 11 SEP 17:08Z
    Microsoft Exchange Server Remote Code Execution Vulnerability
    cvelistv5