CVE-2020-17144: 
vulnerability analysis and mitigation

Microsoft Exchange Remote Code Execution Vulnerability (CVE-2020-17144) was disclosed on December 8, 2020. This vulnerability affects Microsoft Exchange Server software (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Microsoft's own assessment rated it slightly lower at 8.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute code remotely on affected Microsoft Exchange Server systems, potentially compromising the confidentiality, integrity, and availability of the system (NVD).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog on November 3, 2021, indicating that it has been actively exploited in the wild (NVD).

Microsoft has released security updates to address this vulnerability. Organizations are required to apply updates according to vendor instructions. The due date for remediation was set to May 3, 2022, as per CISA's directive (NVD).