Unauthenticated remote code execution

Code injection in Microsoft Exchange Server allows remote attackers to execute code over a network against the affected builds. Microsoft has not disclosed the affected component or the operation that generates executable code from untrusted input. An attacker needs no account, but Microsoft rates exploitation as high complexity and requiring user interaction; successful exploitation runs attacker-controlled code on the server.