A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.
\nAn attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.
\nThe security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.
","dates":{"published":"2020-09-11T17:08:47.000Z","modified":"2024-08-04T13:45:34.048Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.46497,"percentile":0.98812,"severity":"high","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.927,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.47424},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.46497,"percentile":0.98812}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.47424,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.46497,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.46497,"percentile":0.98812}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_F5C497783F0C91A1","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_HTTP_EXCHANGE_ECP_DLP_POLICY","name":"Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/http/exchange_ecp_dlp_policy.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":true,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/http/exchange_ecp_dlp_policy","rank":"600","rankName":"excellent","postAuth":true,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs","account-lockouts","config-changes","artifacts-on-disk"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/74.html"},{"id":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/269.html"}],"affected":[{"vendor":"microsoft","product":"exchange_server","name":"exchange server","label":"exchange_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016:cumulative_update_16","noFixRecorded":false,"fixedIn":null},{"text":"2016:cumulative_update_17","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_5","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_6","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016:cumulative_update_16 | 2016:cumulative_update_17 | 2019:cumulative_update_5 | 2019:cumulative_update_6","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"msexchange","label":"Microsoft Exchange","category":"server-app"}},"hubHref":"/vendor/microsoft/exchange_server"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 16","name":"Microsoft Exchange Server 2016 Cumulative Update 16","label":"microsoft exchange server 2016 cumulative update 16","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.01.0, < publication","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.01.0, < publication","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2016_cumulative_update_16"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 17","name":"Microsoft Exchange Server 2016 Cumulative Update 17","label":"microsoft exchange server 2016 cumulative update 17","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.01.0, < publication","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.01.0, < publication","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2016_cumulative_update_17"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 5","name":"Microsoft Exchange Server 2019 Cumulative Update 5","label":"microsoft exchange server 2019 cumulative update 5","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0, < publication","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0, < publication","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_5"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 6","name":"Microsoft Exchange Server 2019 Cumulative Update 6","label":"microsoft exchange server 2019 cumulative update 6","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0, < publication","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0, < publication","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_6"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875","hostname":"portal.msrc.microsoft.com","tags":["X Refsource MISC","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-09-11T17:08:47.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T13:45:34.048Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T15:32:06.034Z","stale":false,"partial":false}}