CVE-2021-34523: critical vulnerability in Microsoft Exchange Server 2013 Cumulative…
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in Microsoft Exchange Server allows an authenticated attacker to gain higher privileges on the system. This is critical because an insider or someone with basic access can escalate their permissions to administrator level.
This vulnerability permits privilege escalation through improper authorization checks in Exchange Server components. An authenticated user can exploit insufficient validation mechanisms to elevate their privileges to administrative level, potentially compromising the entire mail system and sensitive data.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.