CVE-2021-41349mediumobserved exploitation

CVE-2021-41349: medium-severity vulnerability in Microsoft Exchange Server 2013 Cumulative…

Microsoft Exchange Server Spoofing Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Exchange Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

92Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 6.5epss 93%
from disclosure to weapon57 days
Published on NVDNov 10
1st PoC+57d
VulnCheck+202d
Microsoft Exchange Server Spoofing Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23Microsoft · Microsoft Exchange Server 2016 Cumulative Update 21Microsoft · Microsoft Exchange Server 2016 Cumulative Update 22Microsoft · Microsoft Exchange Server 2019 Cumulative Update 10Microsoft · Microsoft Exchange Server 2019 Cumulative Update 11
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Exchange Server 2013 Cumulative…

In the same product, most dangerous first.

CVE-2021-34473CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-26855CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-34523CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-41040HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEV