CVE-2018-8154: Critical severity Microsoft Exchange Server vulnerability

Published May 9, 2018

Updated

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8151.

Affected Software

6 affected components

Microsoft Exchange Server=2010-sp3

Microsoft Exchange Server=2013-cumulative_update_19

Microsoft Exchange Server=2013-cumulative_update_20

Microsoft Exchange Server=2013-sp1

Microsoft Exchange Server=2016-cumulative_update_8

Microsoft Exchange Server=2016-cumulative_update_9

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8154

Event History

May 9, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 24, 58461

Event

07:55 PM

Frequently Asked Questions

What is the severity of CVE-2018-8154?

CVE-2018-8154 is rated as critical due to its potential for remote code execution.

How do I fix CVE-2018-8154?

To fix CVE-2018-8154, apply the security update released by Microsoft for your specific version of Exchange Server.

Which versions of Microsoft Exchange are affected by CVE-2018-8154?

CVE-2018-8154 affects Microsoft Exchange Server 2010 SP3, 2013 with cumulative updates 19 and 20, and 2016 with cumulative updates 8 and 9.

What are the potential impacts of exploiting CVE-2018-8154?

Exploiting CVE-2018-8154 could allow an attacker to execute arbitrary code on the affected Exchange Server.

Is there a workaround for CVE-2018-8154?

There are no known workarounds for CVE-2018-8154; applying the appropriate security update is critical.