cbcvebase.
CVE-2019-0586
published 2019-01-08

CVE-2019-0586: A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft…

PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
15.40%
96.4th percentile
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
msrcmicrosoft_exchange_server_2010_service_pack_3
msrcmicrosoft_exchange_server_2013_cumulative_update_21
msrcmicrosoft_exchange_server_2013_cumulative_update_22
msrcmicrosoft_exchange_server_2013_cumulative_update_23
msrcmicrosoft_exchange_server_2013_service_pack_1
msrcmicrosoft_exchange_server_2016_cumulative_update_10
msrcmicrosoft_exchange_server_2016_cumulative_update_11
msrcmicrosoft_exchange_server_2016_cumulative_update_12
msrcmicrosoft_exchange_server_2016_cumulative_update_13
msrcmicrosoft_exchange_server_2016_cumulative_update_14
msrcmicrosoft_exchange_server_2016_cumulative_update_15
msrcmicrosoft_exchange_server_2016_cumulative_update_16
msrcmicrosoft_exchange_server_2016_cumulative_update_17
msrcmicrosoft_exchange_server_2016_cumulative_update_18
msrcmicrosoft_exchange_server_2016_cumulative_update_19
msrcmicrosoft_exchange_server_2016_cumulative_update_8
msrcmicrosoft_exchange_server_2016_cumulative_update_9
msrcmicrosoft_exchange_server_2019
msrcmicrosoft_exchange_server_2019_cumulative_update_1

Detection & IOCsextracted from sources · hover to see the quote

  • Exploitation vector is a specially crafted email sent to a vulnerable Exchange server; inspect inbound SMTP traffic for malformed/oversized email objects targeting Exchange memory handling routines.
  • If exploited, attacker code runs as SYSTEM on the Exchange server; monitor for unexpected processes, account creation, or privilege escalation originating from Exchange worker processes (e.g., w3wp.exe, EdgeTransport.exe).
  • ·Exploit status at time of advisory was 'Exploitation More Likely' for both latest and older software releases, but no public exploit or active exploitation was confirmed; detection posture should remain elevated.
  • ·The vulnerability is a memory corruption flaw in Microsoft Exchange's object handling; patching via KB4471389 and associated update packages is the primary remediation.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc9.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.