All vulnerabilities
CVE-2021-42321

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft ExchangeApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 17 Nov 2021. Known ransomware useCISA KEV
Exploit odds (EPSS)91.7%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.01.2308.020Also 15.01.2375.017, 15.02.0792.019 and 1 moreCVE List
Federal deadline1 Dec 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 15.01.2308.020Microsoft Exchange Server 2016 Cumulative Update 21CVE List
  • 15.01.2375.017Microsoft Exchange Server 2016 Cumulative Update 22CVE List
  • 15.02.0792.019Microsoft Exchange Server 2019 Cumulative Update 10CVE List
  • 15.02.0986.014Microsoft Exchange Server 2019 Cumulative Update 11CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 Nov 2021, 00:47 UTCPublishedCVE List
  2. 17 Nov 2021Added to CISA KEVCISA KEV
  3. 9 Dec 2021Exploit code publicMetasploit

Public exploit code and templates 1

  • Exploit moduleMicrosoft Exchange Server ChainedSerializationBinder RCE 9 Dec 2021Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.

Text from CVE List

Affected versions 4

  • Microsoft Exchange Server 2016 Cumulative Update 21affected: 15.01.0 before 15.01.2308.020CVE List
  • Microsoft Exchange Server 2016 Cumulative Update 22affected: 15.0.0 before 15.01.2375.017CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 10affected: 15.02.0 before 15.02.0792.019CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 11affected: 15.02.0 before 15.02.0986.014CVE List

References 4