Exchange 2019, 2016, 2013 and 2010 Security Updates for February 2020

Security updates have been released for Exchange 2010, Exchange 2013, Exchange 2016 and Exchange 2019.

CVE-2020-0688: Microsoft Exchange Validation Key Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time.
Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.
The security update addresses the vulnerability by correcting how Microsoft Exchange creates the keys during install.
CVE-2020-0692: Microsoft Exchange Server Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the same rights as any other user of the Exchange server. This could allow the attacker to perform activities such as accessing the mailboxes of other users.
Exploitation of this vulnerability requires Exchange Web Services (EWS) to be enabled and in use in an affected environment. To exploit the vulnerability, an attacker would need to change parameters in the Security Access Token and forward it to a Microsoft Exchange Server, thereby allowing impersonation of another Exchange user.
To address this vulnerability, Microsoft has changed the way EWS handles these tokens.
This vulnerability does not apply to Exchange 2010.

The updates for Exchange 2010 and Exchange 2013 also contain the following fix;

KB4540267: MSExchangeDelivery.exe or EdgeTransport.exe crashes in Exchange Server 2013 and Exchange Server 2010

Popular Guides