Microsoft Exchange Server Remote Code Execution Vulnerability

published 2020-09-11 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-8833

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 46.5%; EPSS 46.5% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Metasploit

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised. The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.

Patch / fix

links 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875 advisory

Timeline

2020-09-11 Published
2021-01-12 First public exploit (Metasploit exploit/windows/http/exchange_ecp_dlp_policy)

Exploit prediction

46.50% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/http/exchange_ecp_dlp_policy Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE metasploit exploit, excellent rank, 2021-01-12
packetstormsecurity.com http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA	3.1	8.4	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

Microsoft Microsoft Exchange Server 2019 Cumulative Update 5
Microsoft Microsoft Exchange Server 2019 Cumulative Update 6
Microsoft Microsoft Exchange Server 2016 Cumulative Update 16
Microsoft Microsoft Exchange Server 2016 Cumulative Update 17

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-269 Improper Privilege Management

Technology feeds

Microsoft Exchange rss critical rss

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2020-16875
patch, vendor-advisory
packetstormsecurity.com /files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry

Sources

CVE List CVE-2020-16875
NVD CVE-2020-16875

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary