CVE-2021-31196KEV · OVERDUE

Microsoft Exchange Server Information Disclosure Vulnerability

High · published July 14, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

774
days past CISA
deadline
CVSS v3.1
7.2
EPSS
54%
Percentile
99.0
In the wild
Confirmed
What it is

🚨 One seemingly innocent email can unleash full remote code execution on your Microsoft Exchange Server! 🔥 Think of this vulnerability like a sneaky delivery person who hands over a package without checking the ID—once it’s in, all bets are off! 📦 Just like opening your doors to strangers can lead to chaos, this bug opens the floodgates for attackers. An attacker could potentially take control of your server, access sensitive data, or even disrupt critical services—talk about an absolute nightmare! If left unpatched, this vulnerability can wreak havoc on your organization's security and data integrity. ⚡️

Put simply

Think of this vulnerability like a sneaky delivery person who hands over a package without checking the ID—once it’s in, all bets are off! 📦 Just like opening your doors to strangers can lead to chaos, this bug opens the floodgates for attackers. This remote code execution vulnerability exists due to improper handling of requests by Microsoft Exchange Server, allowing attackers to send malicious commands that can be executed on the server.

What to do

An attacker could potentially take control of your server, access sensitive data, or even disrupt critical services—talk about an absolute nightmare! If left unpatched, this vulnerability can wreak havoc on your organization's security and data integrity. ⚡️ Immediate action is crucial! Patch your Microsoft Exchange Server to the latest version, ensure you monitor for any suspicious activity, and review your security policies. Don't neglect to educate your team on safe email practices! 🛡️ You've got this! Follow these steps, and your server will be fortified in no time! 💪✨

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.54056 · 99.0th percentile
Published
2021-07-14T22:15Z
KEV added
2024-08-21 · due 2024-09-11
Affected products (5)
ProductVersionsFixed in
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
References (3)
EPSS history
Timeline
  • 21 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 11
    kev
  • 14 JUL 17:53Z
    Microsoft Exchange Server Remote Code Execution Vulnerability
    cvelistv5