Two bugs are chained to achieve the remote code execution and for the attack to be successful, an attacker requires access to the Outlook Web App portal of the vulnerable Exchange Server, and a valid email address