CVE-2019-1373

—

CVSS 3.1

9.8 critical

EPSS

21%p97

Published

Nov 12, 2019 (Nov 12, 2019)

Modified

Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

Vendors: microsoft
Products: exchange server
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (21.4%)

In the news3 stories

Microsoft Patch Tuesday updates fix CVE-2019

Security AffairsNov 13, 08:26 UTC · Nov 13, 2019Vulnerability in the wildCVE-2019-1429 CVE-2019-1373

November 2019 Patch Tuesday: Actively exploited IE zero-day fixed

Help Net SecurityNov 13, 00:00 UTC · Nov 13, 2019Exploit / PoC in the wildCVE-2019-1429 CVE-2019-16863 CVE-2019-1373+1 CVEs

Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage

Cisco TalosNov 12, 19:58 UTC · Nov 12, 2019Vulnerability CVE-2019-1448 CVE-2019-0721 CVE-2019-1389+70 CVEs