CVE-2021-33766KEV · OVERDUE

Microsoft Exchange Server Information Disclosure

High · published July 14, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.3. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1726
days past CISA
deadline
CVSS v3.1
7.3
EPSS
98%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 This Microsoft Exchange Server vulnerability is like leaving your office door wide open for anyone to peek at your confidential files! Think of your Exchange Server as a busy library. If the staff forget to lock up sensitive sections, anyone can just stroll in and read whatever they want, without a library card! If exploited, an attacker could gain unauthorized access to sensitive information stored within the Exchange Server. This could lead to data leaks, putting both your organization and its clients at serious risk. With the vulnerability actively being exploited, securing your data is more critical than ever!

Put simply

Think of your Exchange Server as a busy library. If the staff forget to lock up sensitive sections, anyone can just stroll in and read whatever they want, without a library card! This information disclosure vulnerability allows unauthorized users to access sensitive data through improper handling of requests in Microsoft Exchange Server.

What to do

If exploited, an attacker could gain unauthorized access to sensitive information stored within the Exchange Server. This could lead to data leaks, putting both your organization and its clients at serious risk. With the vulnerability actively being exploited, securing your data is more critical than ever! Immediately apply the security patch released by Microsoft to mitigate this vulnerability. Additionally, conduct a thorough audit of permissions and access controls to ensure sensitive data is protected. Don't delay on this one! You've got this! By taking these steps, you'll be one step closer to securing your environment. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.98176 · 99.9th percentile
Published
2021-07-14T22:15Z
KEV added
2022-01-18 · due 2022-02-01
Affected products (5)
ProductVersionsFixed in
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
References (4)
EPSS history
Timeline
  • 18 JAN 00:00Z
    Added to CISA KEV — remediate by Feb 1
    kev
  • 14 JUL 17:53Z
    Microsoft Exchange Server Information Disclosure Vulnerability
    cvelistv5