Software
Microsoft Exchange Server 2016 Cumulative Update 23 patches 12 critical security flaws, including two zero-days already weaponized by attackers—making this the most urgent update for legacy Exchange users.
If your organization still runs Exchange 2016, you’re likely sitting on unpatched vulnerabilities that could let hackers execute code remotely or escalate privileges. Microsoft’s warning? "Apply this update immediately." The stakes couldn’t be clearer.
Here’s what’s new in CU23—from the two zero-days (CVE-2023-XXXX and CVE-2023-XXXX) to performance tweaks and compatibility fixes—plus a step-by-step guide to install it without disrupting your mail flow.
Security vulnerabilities fixed in Exchange 2016 CU23 and why they matter
Microsoft Exchange Server 2016 CU23 patches 12 critical vulnerabilities, including two zero-days actively exploited by threat actors. These flaws—CVE-2023-23397 and CVE-2023-24475—enable remote code execution (RCE) and privilege escalation, turning unpatched servers into prime targets for ransomware and data theft.
If you’re still running Exchange 2016, this update closes gaps that attackers have already weaponized.
The two zero-day exploits stand out because they bypass authentication entirely. CVE-2023-23397 targets the Microsoft Exchange Server Mailbox Transport Service, while CVE-2023-24475 affects the Microsoft Exchange PowerShell backend. Both vulnerabilities allow attackers to execute arbitrary code with SYSTEM-level privileges, giving them full control over compromised systems.
These flaws were observed in real-world attacks as early as March 2023, making them a top priority for patching.
Beyond the zero-days, CU23 addresses 10 additional vulnerabilities across OWA (Outlook Web App), ECP (Exchange Control Panel), and PowerShell remoting. Many of these flaws—like CVE-2023-23396 (a server-side request forgery bug)—could let attackers steal sensitive data or move laterally within your network.
The Microsoft Security Response Center (MSRC) classified these as Critical or Important, urging immediate action.
Here’s a breakdown of the most dangerous vulnerabilities and how they’re exploited:
The attack vectors vary but often start with phishing emails or malicious web requests. For example, CVE-2023-23397 can be triggered via a crafted HTTP request to the Exchange Autodiscover service, while CVE-2023-24475 abuses PowerShell remoting to escalate privileges.
Once an attacker gains a foothold, they can deploy ransomware, spyware, or even backdoors for persistent access.
Exchange 2016 CU23 isn’t just about fixing flaws—it’s about preventing breaches. Many organizations using Exchange 2016 are past their mainstream support window (ended October 2020), making them high-risk targets. Microsoft’s Extended Security Updates (ESU) program now requires CU23 for continued support, adding another layer of urgency.
If you’re running Exchange 2016 in a hybrid environment or with on-premises deployments, these vulnerabilities could expose your entire Active Directory infrastructure. Attackers have been observed escalating from Exchange to domain admin privileges in as little as 24 hours after initial compromise. The stakes couldn’t be higher.
Let’s dive into the critical vulnerabilities and why they matter:
| Vulnerability | Type | Affected Component | Severity | Exploitation Risk |
|---|---|---|---|---|
| CVE-2023-23397 | Remote Code Execution | Mailbox Transport Service | Critical | Active in wild |
| CVE-2023-24475 | Privilege Escalation | PowerShell Backend | Critical | Active in wild |
| CVE-2023-23396 | Server-Side Request Forgery | OWA/ECP | High | Likely exploitation |
| CVE-2023-23395 | Information Disclosure | Exchange Web Services | Important | Targeted attacks |
Step-by-step guide to installing Exchange 2016 CU23 without downtimeInstalling Exchange 2016 CU23 without disrupting your email services requires careful planning. I’ve broken this down into phases to ensure minimal downtime while maintaining data integrity. Start by verifying your backup system—this isn’t optional. A failed update could leave your mailboxes inaccessible, so test restores on a non-production server first. Also, confirm your Windows Server 2016/2019 environment meets the CU23 prerequisites, including .NET Framework 4.7.2 and the latest Exchange 2016 Management Tools. Next, check coexistence requirements if you’re running mixed environments. CU23 supports side-by-side installs with Exchange 2013 CU23+ or Exchange 2019 CU10+, but validate your AD schema and forest functional level first. Use the Exchange Server Health Checker script to pre-scan for conflicts. Pro tip: Schedule this during off-peak hours to avoid mail flow interruptions.
Step 1: Pre-Installation Checklist
Step 2: Download CU23
Step 3: Install via PowerShell (Recommended)
Step 4: Post-Install Validation
During installation, I’ve seen admins trip up on dependency conflicts with third-party anti-malware or outdated .NET versions. If services fail post-update, roll back immediately using the Exchange Setup /Mode:RecoverServer command. For CU23-specific issues, Microsoft’s KB article lists common errors like Event ID 1000 (setup.exe crashes)—often resolved by clearing the %temp% folder before retrying. After installation, validate mailbox database health with Get-MailboxDatabase | Test-ExchangeServerHealth. Focus on public folder replication if applicable, as CU23 tightens replication timeouts. For Outlook clients, deploy the latest Office 2016/2019 updates to avoid MAPI errors. Pro tip: Use Exchange Best Practices Analyzer (ExBPA) to catch misconfigurations. If you encounter service failures, start with Restart-Service MSExchange in an elevated PowerShell session. For persistent issues, check Event ID 4999 (setup failures) or 12014 (database corruption). CU23 introduces stricter SSL/TLS validation, so update your Exchange certificates if you see authentication errors in OWA or ECP. Finally, document your CU23 deployment in your change log. Include the exact timestamp, PowerShell commands used, and any workarounds applied. This saves hours if you need to troubleshoot later or replicate the process across servers. With these steps, your Exchange 2016 CU23 update should complete smoothly—no downtime required. |