Exploited· due 2021-11-179.1criticalCriticalused in ransomware
CVE-2021-34473
Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Exploitation status
- CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
- It is known to have been used in ransomware campaigns.
- US federal civilian agencies are required to remediate it by 2021-11-17. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
- A vendor advisory or patch reference has been published.
Required action
Apply updates per vendor instructions.
CISA’s wording, unedited.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 9.1 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness
- CWE-918
- Assigned by
- secure@microsoft.com
Dates
- Published
- 2021-07-14
- Last modified
- 2026-08-10
- Added to KEV
- 2021-11-03
- Remediation due
- 2021-11-17
- Sources
- CISA KEV, NVD
Affected products
- Microsoft Exchange Server2013, 2016, 2019
As listed in the NVD configuration data. Not a statement about your estate.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473
- http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473
- https://www.zerodayinitiative.com/advisories/ZDI-21-821/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473