CVE-2024-21410: critical vulnerability in Microsoft Exchange Server 2016 Cumulative…
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A critical flaw in Microsoft Exchange Server allows an authenticated user to gain system administrator privileges without proper authorization. This vulnerability enables attackers who have basic access to take complete control of the email server.
An authentication bypass vulnerability (CWE-287) in Microsoft Exchange Server permits privilege escalation from authenticated user to SYSTEM level. The attack requires valid user credentials but no additional exploitation; successful exploitation grants complete administrative control over the Exchange environment.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.