CVE-2021-34473criticalunder attackransomwareCWE-918

CVE-2021-34473: critical vulnerability in Microsoft Exchange Server 2013 Cumulative…

Microsoft Exchange Server Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Exchange Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 2 threat group(s) use it.

ssvc Actcvss 9.1epss 100%
from disclosure to weapon27 days
Published on NVDJul 14
1st PoC+27d
metasploitApr 6
CISA KEV+112d
Who exploits it — 2

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBRONZE BUTLER🇨🇳 CISA
APT / StateMagic Hound🇮🇷 MITRE ATT&CK
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A critical flaw in Microsoft Exchange Server allows attackers to execute arbitrary code remotely without authentication. This affects email servers worldwide and can lead to complete system compromise.

Technical detail

Server-Side Request Forgery (SSRF) vulnerability in Exchange Server's Autodiscover service allows unauthenticated attackers to bypass authentication mechanisms and achieve Remote Code Execution through malicious requests. The vulnerability enables execution of arbitrary PowerShell commands with System privileges, requiring only network access to the affected server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19Microsoft · Microsoft Exchange Server 2016 Cumulative Update 20Microsoft · Microsoft Exchange Server 2019 Cumulative Update 8Microsoft · Microsoft Exchange Server 2019 Cumulative Update 9
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Exchange Server 2013 Cumulative…

In the same product, most dangerous first.

CVE-2021-26855CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-34523CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-41040HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEVCVE-2021-31207MEDIUMMicrosoft Exchange Server Security Feature Bypass VulnerabilityEPSS 99.8%KEV